General
- Target Unconfirmed 757120.crdownload
- Size 13.0MB
- Sample240227-lpd3kade66
- SHA256 300c090861a547a4c211b15b9f45d6dcb976128c21b78b6c38d1cf4c5d998e12
Malware Config
Extracted
-
cobaltstrike
-
51451532
-
http://pandorasong.com:443/access/
-
access_type
512
-
beacon_type
2048
-
host
pandorasong.com,/access/
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAeR2V0Q29udGVudEZlYXR1cmVzLkRMTkEuT1JHOiAxAAAACgAAABVIb3N0OiBwYW5kb3Jhc29uZy5jb20AAAAKAAAASENvb2tpZTogIF9fdXRtYT0zMTAwNjY3MzMuMjg4NDUzNDQ0MC4xNDMzMjAxNDYyLjE0MDMyMDQzNzIuMTM4NTIwMjQ5OC43OwAAAAkAAAAJdmVyc2lvbj00AAAACQAAAA5saWQ9MTU4MjUwMjcyNAAAAAcAAAAAAAAACAAAAAUAAAAFdG9rZW4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFUhvc3Q6IHBhbmRvcmFzb25nLmNvbQAAAAcAAAAAAAAABQAAAANyaWQAAAAJAAAADmxpZD0xNjgzNTAzNzM1AAAACQAAAB9tZXRob2Q9Z2V0U2VhcmNoUmVjb21tZW5kYXRpb25zAAAABwAAAAEAAAADAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
jitter
4352
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
300000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCN7UFLcBHjvme4lLXoOKMyNrF46j4Xi87J4ilrNPDQxLOq2KHaCXP+0FsWYs7JFqLXGmqOIfALpPLIyGgnRuC60ZXaSKmCENE2O88Z0BxDkRxSaKEbgv3ETo/Ra7cF8JNr3szy0sNBVyi9dhS2WhXRIU923X2ZQxbpSyUNi5Q//wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
7.382016e+08
-
unknown2
AAAABAAAAAIAAAAQAAAAAgAAABAAAAACAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/radio/xmlrpc/v45
-
user_agent
Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
51451532
Targets
-
- Target Unconfirmed 757120.crdownload
- Size 13.0MB
- SHA256 300c090861a547a4c211b15b9f45d6dcb976128c21b78b6c38d1cf4c5d998e12
Score1/10 -
- Target Coll.CozyBear
- Size 12.8MB
- SHA256 fdef234179cd467f728ae51dbb206f1577bc2d73834d105e51a824063f4926c0
Score1/10 -
- Target APT29miniduke.bin
- Size 140KB
- SHA256 dd215d76bcfd72ebcfb50ccfeb9fb1703af4bbf4821de225009f43fc4e08e432
Score3/10 -
- Target CozyBearImplant.bin
- Size 3.0MB
- SHA256 b101cd29e18a515753409ae86ce68a4cedbe0d640d385eb24b9bbb69cf8186ae
Score7/10UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target out.upx
- Size 2.4MB
- SHA256 d0e083c0154681050e66820be0f2bd64ce764536afb068200a4455ef8fd9d81d
Score3/10 -
- Target ImplantCozy.bin
- Size 3.0MB
- SHA256 6c1bce76f4d2358656132b6b1d471571820688ccdbaca0d86d0ca082b9390536
Score7/10UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target out.upx
- Size 2.4MB
- SHA256 845f4f84ff1e4dc1e06a9d9996c2758551a41ba0eaff37be920d48512b359a46
Score3/10 -
- Target MinidukeAPT29.bin
- Size 140KB
- SHA256 c485cbcd5b21db8029654bd47879f086feed41492aebed33a9afe9d73f5069e7
Score3/10 -
- Target Nov2018New!/.DS_Store
- Size 6KB
- SHA256 d65165279105ca6773180500688df4bdc69a2c7b771752f0a46ef120b7fd8ec3
Score3/10 -
- Target Nov2018New!/AudioSes.dll
- Size 287KB
- SHA256 b77ff307ea74a3ab41c92036aea4a049b3c2e69b12a857d26910e535544dfb05
Score10/10Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
Blocklisted process makes network request
-
- Target Nov2018New!/CozybearNov2018Activity.txt
- Size 148B
- SHA256 07a1d57137b3a7bea66f2f599c95aaf7765e24bcbbefcaf6f7885381d92ded89
Score3/10 -
- Target Nov2018New!/ds7001.zip
- Size 228KB
- SHA256 e2945268c976f8dc33ba9a8d1a804f00cff46aabc01cd3196651322a71863b87
Score1/10 -
- Target ds7002.lnk
- Size 392KB
- SHA256 2cea2a1f53dac3f4fff156eacc2ecc8e98b1a64f0f5b5ee1c42c69d9a226c55c
Score10/10Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
Blocklisted process makes network request
Loads dropped DLL
-
- Target Nov2018New!/ds7002.bin
- Size 392KB
- SHA256 2cea2a1f53dac3f4fff156eacc2ecc8e98b1a64f0f5b5ee1c42c69d9a226c55c
Score10/10Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
Blocklisted process makes network request
Loads dropped DLL
-
- Target Nov2018New!/ds7002.zip
- Size 54KB
- SHA256 1cc77858e5f3513a051a8cf2895891eebe52fdd604017b55030fed0d63cf3faf
Score1/10 -
- Target ds7002.pdf
- Size 85KB
- SHA256 b1c811d3f0e930b0096a9e785f730ba4d92458bd6dcfbdff4cf7a1e247ef20d1
Score1/10 -
- Target SeaDaddyImplant (2).bin
- Size 3.0MB
- SHA256 6c1bce76f4d2358656132b6b1d471571820688ccdbaca0d86d0ca082b9390536
Score7/10UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target out.upx
- Size 2.4MB
- SHA256 845f4f84ff1e4dc1e06a9d9996c2758551a41ba0eaff37be920d48512b359a46
Score3/10 -
- Target SeaDaddyImplant.bin
- Size 3.0MB
- SHA256 b101cd29e18a515753409ae86ce68a4cedbe0d640d385eb24b9bbb69cf8186ae
Score7/10UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target out.upx
- Size 2.4MB
- SHA256 d0e083c0154681050e66820be0f2bd64ce764536afb068200a4455ef8fd9d81d
Score3/10 -
- Target TrojanCozyBear.bin
- Size 330KB
- SHA256 01468b1d3e089985a4ed255b6594d24863cfd94a647329c631e4f4e52759f8a9
Score8/10Adds policy Run key to start application
Executes dropped EXE
Loads dropped DLL
Registers COM server for autorun
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target atiagentCozyBear.bin
- Size 52KB
- SHA256 43cd9ef6904c35c6854bf59d99731a05048af9e870261064a255db0181930fad
Score1/10