General
-
Target
3909b9173ef889d067e9a24b3a514f493f0ebeec7fb4e40d47968fce0fa5cce3
-
Size
971KB
-
Sample
240325-scrlfseb3v
-
MD5
7bc6db477913ee50021fd5d1deb6a338
-
SHA1
e6a3b39af3b319bf42427a5db6125489d466ba5c
-
SHA256
3909b9173ef889d067e9a24b3a514f493f0ebeec7fb4e40d47968fce0fa5cce3
-
SHA512
022279153e7d66f40d34e289f2b86da57e58a4998ef1b1ded2d264a21bea90a97ed2cb8288049a2763680c7b578c38f89a2f6514039622cec32da1dd5f609f18
-
SSDEEP
12288:JycEiDYbDka2fyvDKidjWoEEwkdWmzzB5FavJz9tSAhj7r:JdDY3kapoMB6v5fSA17
Static task
static1
Behavioral task
behavioral1
Sample
3909b9173ef889d067e9a24b3a514f493f0ebeec7fb4e40d47968fce0fa5cce3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3909b9173ef889d067e9a24b3a514f493f0ebeec7fb4e40d47968fce0fa5cce3.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
cobaltstrike
http://50.118.225.251:2333/1Omp
-
user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.4; InfoPath.2)
Extracted
cobaltstrike
100000
http://50.118.225.251:2333/en_US/all.js
-
access_type
512
-
host
50.118.225.251,/en_US/all.js
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
2333
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCHa0DecRzdliCqGv38W+JICnkPCK+XJWiXEoou1cpZ0MX/ea1PJOWrv016JpN/rAlIeOTvhT2YDIDU11F5EEXql1BqYhuheUnEMbEXer61D2Z2LE723YBqlwQdo2H5ao3lVMXW2/Kx7xM6IuhrvibaQGsqAU5UCZja/MLQvh45mQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET CLR 2.0.50727)
-
watermark
100000
Extracted
cobaltstrike
0
-
watermark
0
Targets
-
-
Target
3909b9173ef889d067e9a24b3a514f493f0ebeec7fb4e40d47968fce0fa5cce3
-
Size
971KB
-
MD5
7bc6db477913ee50021fd5d1deb6a338
-
SHA1
e6a3b39af3b319bf42427a5db6125489d466ba5c
-
SHA256
3909b9173ef889d067e9a24b3a514f493f0ebeec7fb4e40d47968fce0fa5cce3
-
SHA512
022279153e7d66f40d34e289f2b86da57e58a4998ef1b1ded2d264a21bea90a97ed2cb8288049a2763680c7b578c38f89a2f6514039622cec32da1dd5f609f18
-
SSDEEP
12288:JycEiDYbDka2fyvDKidjWoEEwkdWmzzB5FavJz9tSAhj7r:JdDY3kapoMB6v5fSA17
Score10/10 -