General
-
Target
7fb7654082c8d7cd86bed9d2cd34ed4ab91993a003c958f3f82ea6fe321830cf
-
Size
289KB
-
Sample
240322-df63zshg8s
-
MD5
2e0df0cca97ec227f889fa897358ffe9
-
SHA1
b057f2906f3913a4c4175720c7923f709f7cee61
-
SHA256
7fb7654082c8d7cd86bed9d2cd34ed4ab91993a003c958f3f82ea6fe321830cf
-
SHA512
4b6ab4baad9a3d469678ef481fb51b2a68ff73910acd5a2e25c5ce1cab201da71e2a7d741f96cf94c851dc5cec987a59eed5ddd4ad1f6dbb5fb5dc4f7741210a
-
SSDEEP
6144:a78h2rj+Tp9JMW2lBB7mSCZ6lfGhpFUzRX8p6pEn/OkA3E:eW2rCTnJM9kufGvFUzRX8pIpkA
Static task
static1
Behavioral task
behavioral1
Sample
7fb7654082c8d7cd86bed9d2cd34ed4ab91993a003c958f3f82ea6fe321830cf.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
7fb7654082c8d7cd86bed9d2cd34ed4ab91993a003c958f3f82ea6fe321830cf.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
cobaltstrike
391144938
http://47.120.39.201:5588/activity
-
access_type
512
-
host
47.120.39.201,/activity
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
5588
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCq0wMajf1TQm2YmvT82KH4HIlbvIC3c/kEEhe8LEGvZ6o7vsEAyU2IUla2YdZgzaeyHQ5c/QjuCyhrKYzGFmGZthX9OIEjaN0NrVr3E3TyOrZ/ue6FpYsKrsI5O4c5VJhoLAjuA7F+T98jaj8A3lZdr34LfBy3M3vZ1ZdsMWUL+QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.3; .NET CLR 2.0.50727)
-
watermark
391144938
Targets
-
-
Target
7fb7654082c8d7cd86bed9d2cd34ed4ab91993a003c958f3f82ea6fe321830cf
-
Size
289KB
-
MD5
2e0df0cca97ec227f889fa897358ffe9
-
SHA1
b057f2906f3913a4c4175720c7923f709f7cee61
-
SHA256
7fb7654082c8d7cd86bed9d2cd34ed4ab91993a003c958f3f82ea6fe321830cf
-
SHA512
4b6ab4baad9a3d469678ef481fb51b2a68ff73910acd5a2e25c5ce1cab201da71e2a7d741f96cf94c851dc5cec987a59eed5ddd4ad1f6dbb5fb5dc4f7741210a
-
SSDEEP
6144:a78h2rj+Tp9JMW2lBB7mSCZ6lfGhpFUzRX8p6pEn/OkA3E:eW2rCTnJM9kufGvFUzRX8pIpkA
Score10/10 -