General
-
Target
db29d48d44edec539ab23cca9b9bbae2
-
Size
850KB
-
Sample
240321-kdcjxsfd54
-
MD5
db29d48d44edec539ab23cca9b9bbae2
-
SHA1
b39893b26c27996b258ea9f218e13930a04bfed5
-
SHA256
9031447f19a071e49ac7e8ff1088d0eafc2f17910ad08ed09978402a0f9a44c1
-
SHA512
3d26029b836cc2d30f8b1a978df4e9ee8bb87e38f334df77c86770eec5273826274f1af2f3ca95927d7e5cd745ef3516c890a02b9ec1e5e1ba57bcc01964519c
-
SSDEEP
1536:MXsB0ro2xWzF/2BzjFepXBvEQQSZJgGjq+6+N68RhgWL5eFPPUp2yWoHE2hlICE+:ME
Static task
static1
Behavioral task
behavioral1
Sample
db29d48d44edec539ab23cca9b9bbae2.ps1
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
db29d48d44edec539ab23cca9b9bbae2.ps1
Resource
win10v2004-20240226-en
Malware Config
Extracted
cobaltstrike
305419896
http://office.symanteccdn.com:80/_/scs/mail-static/_/js/
-
access_type
512
-
dns_idle
1.34744072e+08
-
host
office.symanteccdn.com,/_/scs/mail-static/_/js/
-
http_header1
AAAABwAAAAAAAAADAAAAAgAAAAVPU0lEPQAAAAYAAAAGQ29va2llAAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAfQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAACgAAAAZETlQ6IDEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACQAAAA11aT1kMzI0NGM0NzA3AAAACQAAAAtob3A9NjkyODYzMgAAAAkAAAAHc3RhcnQ9MAAAAAoAAAA9Q29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQ7Y2hhcnNldD11dGYtOAAAAAcAAAAAAAAAAwAAAAIAAAAFT1NJRD0AAAAGAAAABkNvb2tpZQAAAAcAAAABAAAAAwAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
jitter
3840
-
maxdns
255
-
polling_time
50000
-
port_number
80
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDBRb6drQE84GpU2j1hqgNtb6/jpxufM6HE1LOOUiemMUsM/z4UmbWhLbgPoflld9u3NWXTIOlOxE9NW53/9EaTNcwG+ac0GyK1Ks67vwXFnHxJtSR0ofbJ2fMuSG//6cRsYvkI15eCv6VKtmtnMZykoGf+6+CQt+9KA2hfKvTTWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
5.37071616e+08
-
unknown2
AAAABAAAAAEAAAF3AAAAAQAAAPoAAAACAAAABAAAAAIAAAAcAAAAAgAAACQAAAACAAAAEgAAAAIAAAAEAAAAAgAAABwAAAACAAAAJAAAAAIAAAARAAAAAgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/mail/u/0/
-
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0; MASP)
-
watermark
305419896
Targets
-
-
Target
db29d48d44edec539ab23cca9b9bbae2
-
Size
850KB
-
MD5
db29d48d44edec539ab23cca9b9bbae2
-
SHA1
b39893b26c27996b258ea9f218e13930a04bfed5
-
SHA256
9031447f19a071e49ac7e8ff1088d0eafc2f17910ad08ed09978402a0f9a44c1
-
SHA512
3d26029b836cc2d30f8b1a978df4e9ee8bb87e38f334df77c86770eec5273826274f1af2f3ca95927d7e5cd745ef3516c890a02b9ec1e5e1ba57bcc01964519c
-
SSDEEP
1536:MXsB0ro2xWzF/2BzjFepXBvEQQSZJgGjq+6+N68RhgWL5eFPPUp2yWoHE2hlICE+:ME
Score10/10 -