Overview

overview

10

Static

static

10

9ea53fae45...6cc7ba

windows7-x64

1

9ea53fae45...6cc7ba

windows10-1703-x64

1

9ea53fae45...6cc7ba

windows10-2004-x64

1

9ea53fae45...6cc7ba

windows11-21h2-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9ea53fae458b50e87d36f80caf88fc26b255d976cdca0b5e8ef881e7936cc7ba

  • Size

    207KB

  • Sample

    240417-fjr5cafg8s

  • MD5

    91d30cc1be49e36a0edd45158689d767

  • SHA1

    f03b808339ca18370ba9cdaace2791a854ad995f

  • SHA256

    9ea53fae458b50e87d36f80caf88fc26b255d976cdca0b5e8ef881e7936cc7ba

  • SHA512

    bb9cb128a4b7fab68915184876fd8d3a2bb86bc3ec004911267dbc6a87ae977411f80318aa210162d63ef383b84c2c89bc9e6e477557f06295eb3c2538649fc8

  • SSDEEP

    6144:u15CIV4pKTgeM+/QdExuFjYFlSCXpkQlK:5DpKT//QdEiYFXCsK

Score
10/10
cobaltstrike0

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://js.msedgeupdate.com:443/IE9CompatViewList.xml

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    js.msedgeupdate.com,/IE9CompatViewList.xml

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • polling_time

    100

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYZ50MemjbJxn0jsX6NpbNNbIN0b6O0TyHWyw9mZGfVbVXgVzhUobopewBXb/IURqLIpwyALYpRhcbIrWawBGYE5cifA5iTf38cB9Wy30li7PUv8oQ3Ae7YOfVIu/ORve4kX9rdhGworsKN/sJuvpngxGvqtRWg/A8VDdX8/AEZwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

  • watermark

    0

Targets

    • Target

      9ea53fae458b50e87d36f80caf88fc26b255d976cdca0b5e8ef881e7936cc7ba

    • Size

      207KB

    • MD5

      91d30cc1be49e36a0edd45158689d767

    • SHA1

      f03b808339ca18370ba9cdaace2791a854ad995f

    • SHA256

      9ea53fae458b50e87d36f80caf88fc26b255d976cdca0b5e8ef881e7936cc7ba

    • SHA512

      bb9cb128a4b7fab68915184876fd8d3a2bb86bc3ec004911267dbc6a87ae977411f80318aa210162d63ef383b84c2c89bc9e6e477557f06295eb3c2538649fc8

    • SSDEEP

      6144:u15CIV4pKTgeM+/QdExuFjYFlSCXpkQlK:5DpKT//QdEiYFXCsK

    Score
    1/10
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Matrix

Tasks