General
-
Target
f80c6e4440cf1178da196f253878e4869a444cfd39355240f52664884c884611
-
Size
208KB
-
Sample
240417-g7jzbahd8y
-
MD5
a6262357dc39bada44ffe725707fec7c
-
SHA1
4cdccab81a05c8d6c86443e6c566c5912503420c
-
SHA256
f80c6e4440cf1178da196f253878e4869a444cfd39355240f52664884c884611
-
SHA512
7f647b3338edd86c73dbc53c30e747743f2b4c1e7d3976bee80cb2e08c0f7d3c2e668f291914504f0bf13eb8e2773b3983ad2e0b1c6f15ea19b71e9a4aae1a1f
-
SSDEEP
3072:aI6CqRCxffkClDn7LQlRw6x+Y3CxT2DtK5jdUfY5w:aIDff9NXYRw6MT2DEj
Behavioral task
behavioral1
Sample
f80c6e4440cf1178da196f253878e4869a444cfd39355240f52664884c884611.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f80c6e4440cf1178da196f253878e4869a444cfd39355240f52664884c884611.dll
Resource
win10v2004-20240226-en
Malware Config
Extracted
cobaltstrike
100000
http://192.168.84.1:8080/updates.rss
-
access_type
512
-
host
192.168.84.1,/updates.rss
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
8080
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCbR9DNuWRVZuUF0/UoJnVwbN+BKOedxFYmzGqMua//T0DzRpqfEcIRILnW6V8a3ggQHLKYvYQGL6tbGa5mBOeaOEfjot/Jwo0AWF45uMtknuyobCsrpKbhidSn6YPS0K4bJukOPS/wec2ooZI3AgT52MLI76GB11ezozPItYOYhQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
-
watermark
100000
Targets
-
-
Target
f80c6e4440cf1178da196f253878e4869a444cfd39355240f52664884c884611
-
Size
208KB
-
MD5
a6262357dc39bada44ffe725707fec7c
-
SHA1
4cdccab81a05c8d6c86443e6c566c5912503420c
-
SHA256
f80c6e4440cf1178da196f253878e4869a444cfd39355240f52664884c884611
-
SHA512
7f647b3338edd86c73dbc53c30e747743f2b4c1e7d3976bee80cb2e08c0f7d3c2e668f291914504f0bf13eb8e2773b3983ad2e0b1c6f15ea19b71e9a4aae1a1f
-
SSDEEP
3072:aI6CqRCxffkClDn7LQlRw6x+Y3CxT2DtK5jdUfY5w:aIDff9NXYRw6MT2DEj
Score3/10 -