General
-
Target
970f6411be52d7edb228c30b4c09e2e85313a905a6a50718d14b91057caaf47b
-
Size
5.3MB
-
Sample
240408-2y4btahg2y
-
MD5
71298c6267e75829a010d4f9865eee4e
-
SHA1
899760242eb69420c42e7b051dc5d067c8af76ea
-
SHA256
970f6411be52d7edb228c30b4c09e2e85313a905a6a50718d14b91057caaf47b
-
SHA512
e7e1c8c7751fb7216f1d70ed6f2001a8a9f6e9e9709874b4fe6980a6d31feb6ee9d46d9dae065bbb29e46c9829b638c1171f09d719618a628d79750292fa8677
-
SSDEEP
98304:ZMKKkv47Ffneb2RjDv4w0ZXpIY0icDJZDMM/mo1:ZMKKkv4pneb2pEjSJZp51
Static task
static1
Behavioral task
behavioral1
Sample
970f6411be52d7edb228c30b4c09e2e85313a905a6a50718d14b91057caaf47b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
970f6411be52d7edb228c30b4c09e2e85313a905a6a50718d14b91057caaf47b.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
cobaltstrike
100000
http://y-bodies.at.playit.gg:53626/ga.js
-
access_type
512
-
host
y-bodies.at.playit.gg,/ga.js
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQWNjZXB0LUxhbmd1YWdlOiBlbi11cwAAAAoAAAAbQWNjZXB0LUVuY29kaW5nOiB0ZXh0L3BsYWluAAAACgAAAC9Db250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsdHJ5dHJ5ZAAAAAcAAAAAAAAAAwAAAAIAAAAiU0VTU0lPTklEPXdxZTQ1NHdxZTJkczE1ZHM0ZHNhNWRzNAAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQWNjZXB0LUxhbmd1YWdlOiBlbi11cwAAAAoAAAAbQWNjZXB0LUVuY29kaW5nOiB0ZXh0L3BsYWluAAAACgAAAC9Db250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsdHJ5dHJ5ZAAAAAcAAAAAAAAAAwAAAAIAAAAjSlNFU1NJT049ZHNmNXNkNGY1ZTQ1ZmU0czY1ZDRmODU2ZTQAAAAGAAAABkNvb2tpZQAAAAcAAAABAAAAAwAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
7680
-
polling_time
10000
-
port_number
53626
-
sc_process32
%windir%\syswow64\werfault.exe
-
sc_process64
%windir%\sysnative\werfault.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCz1pB1OGztUf+2qNasg5+nIjbf962xWu4gKqm287zFw03lnK1digsxtAQB7FNiTxFrNKuhdGooQZ/+8jnzkFVFjP+O3ssdv+ATHL726NZNTqDRVNAOlt6DCNga51FWD8PBRsxqw++CqmBpVX67SHzt2icEzWI14ksoAW+5RK2ifQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
1.481970944e+09
-
unknown2
AAAABAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/index.php
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36
-
watermark
100000
Targets
-
-
Target
970f6411be52d7edb228c30b4c09e2e85313a905a6a50718d14b91057caaf47b
-
Size
5.3MB
-
MD5
71298c6267e75829a010d4f9865eee4e
-
SHA1
899760242eb69420c42e7b051dc5d067c8af76ea
-
SHA256
970f6411be52d7edb228c30b4c09e2e85313a905a6a50718d14b91057caaf47b
-
SHA512
e7e1c8c7751fb7216f1d70ed6f2001a8a9f6e9e9709874b4fe6980a6d31feb6ee9d46d9dae065bbb29e46c9829b638c1171f09d719618a628d79750292fa8677
-
SSDEEP
98304:ZMKKkv47Ffneb2RjDv4w0ZXpIY0icDJZDMM/mo1:ZMKKkv4pneb2pEjSJZp51
Score10/10 -