General
-
Target
f3997aa374b51601e2bdf695ac5f85e7149e0af7df9e06dbf5cfedb4c6eed26f
-
Size
289KB
-
Sample
240308-ly5xmsdb4s
-
MD5
17bb54c3bd96a65cfbc1af2b9db7f7e2
-
SHA1
e41b4c781d2218c4b41f0f8758d6f5c92695a6c3
-
SHA256
f3997aa374b51601e2bdf695ac5f85e7149e0af7df9e06dbf5cfedb4c6eed26f
-
SHA512
dfd7fc61440d12b6568e82d1fd45be3d0f17c1d583c2a8811015f19c06af3940cee01c03fea6fbdaae280d7fa797193376f0aaa9e69e4a06e51e81ddcc56b9d5
-
SSDEEP
6144:DYC++CtvLBqSxHfOVVcY7gP64c7zhSCdaSXKhXBzmHKD0q+wee:DYHTtVqiHfODNgPcfhSCdJahXB6qD0q0
Static task
static1
Behavioral task
behavioral1
Sample
f3997aa374b51601e2bdf695ac5f85e7149e0af7df9e06dbf5cfedb4c6eed26f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f3997aa374b51601e2bdf695ac5f85e7149e0af7df9e06dbf5cfedb4c6eed26f.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
cobaltstrike
391144938
http://23.224.174.186:6666/updates.rss
-
access_type
512
-
host
23.224.174.186,/updates.rss
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
6666
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVU/JnpNmby7p3br52JBRANOc5cEwbbbTh6poeyTO5Y3JI+vk3POygF+KJm3i9r51MIvxETGAhAZ1q1JjBVTrZDGUDAhfS9a68NowCLODbihwdIutdPhrs219W1AhyiV0Y8tXCsKmSS7dSuhi81haM8uBfCy/lzSCIWHoffhKA9wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; MANM)
-
watermark
391144938
Targets
-
-
Target
f3997aa374b51601e2bdf695ac5f85e7149e0af7df9e06dbf5cfedb4c6eed26f
-
Size
289KB
-
MD5
17bb54c3bd96a65cfbc1af2b9db7f7e2
-
SHA1
e41b4c781d2218c4b41f0f8758d6f5c92695a6c3
-
SHA256
f3997aa374b51601e2bdf695ac5f85e7149e0af7df9e06dbf5cfedb4c6eed26f
-
SHA512
dfd7fc61440d12b6568e82d1fd45be3d0f17c1d583c2a8811015f19c06af3940cee01c03fea6fbdaae280d7fa797193376f0aaa9e69e4a06e51e81ddcc56b9d5
-
SSDEEP
6144:DYC++CtvLBqSxHfOVVcY7gP64c7zhSCdaSXKhXBzmHKD0q+wee:DYHTtVqiHfODNgPcfhSCdJahXB6qD0q0
Score10/10 -