General
-
Target
f0907b48aecc2c1fe36c2463223cab296fd3210ee822f0d3e7101cc66832ec22
-
Size
286KB
-
Sample
240522-trtj2agh6z
-
MD5
90c76a9f74c351ca109c78beac808b44
-
SHA1
f0f25993c79a7318d9fc71adba8383495e774746
-
SHA256
f0907b48aecc2c1fe36c2463223cab296fd3210ee822f0d3e7101cc66832ec22
-
SHA512
c8f5ee74e0c395d35843220b936d85771b01258d890c9c149a805e3e021f0238eaaeb39bc755ea61222c5082b13121cb28ff4c94c226510a2739edac32825e20
-
SSDEEP
6144:L6jmbBX0ZeLle3mNfnzrktMQiaXJI4sbN2dcc:LombB0ce3YnvXF8C4qc
Malware Config
Extracted
cobaltstrike
1580103824
http://-I�`�1��*�,1P��! pv���JzW����]��uY��主�!ex�Hb2��a912�A��`~� ����x���PE:0
http://energy.stf.13.pttsecurity.ru:443/c/msdownload/update/others/2021/05/
-
access_type
512
-
beacon_type
2048
-
host
energy.stf.13.pttsecurity.ru,/c/msdownload/update/others/2021/05/
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAApTVMtQ1Y6IGRMVWpYSTNsaVVhVG03VEwuMi4wLjAuMi4yLjMuMS4xLjIAAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAABwAAAAAAAAAPAAAADQAAAAEAAAAELmNhYgAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAARQ29ubmVjdGlvbjogY2xvc2UAAAAHAAAAAQAAAA8AAAANAAAAAQAAAAQuY2FiAAAADAAAAAcAAAAAAAAADwAAAA0AAAABAAAAEi4yLjAuMC4yLjIuMy4xLjEuMgAAAAYAAAAFTVMtQ1YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
GET
-
jitter
2560
-
polling_time
1000
-
port_number
443
-
sc_process32
%windir%\syswow64\pcaui.exe
-
sc_process64
%windir%\sysnative\pcaui.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC0qtJmA3UjakIHeANpfI/nhI373MjFvXI8xWTlDvF+DFgmQFisI2Ax7CX0kKUlgkfSgbt3BSUtTfvkrG8s9gdLYNlIcBX7hGBKzHJsObEW/cxO5/CjvOfUg22/NZEmjRN0s7CQ1n6kYlnAN421gw5/w4WIr0lTdyr9qqzGKCNHiwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
2.01330688e+08
-
unknown2
AAAABAAAAAIAAAAEAAAADwAAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown3
1.610612736e+09
-
uri
/c/msdownload/update/defu/2021/05/
-
user_agent
Microsoft-Delivery-Optimization/10.0
-
watermark
1580103824
Targets
-
-
Target
f0907b48aecc2c1fe36c2463223cab296fd3210ee822f0d3e7101cc66832ec22
-
Size
286KB
-
MD5
90c76a9f74c351ca109c78beac808b44
-
SHA1
f0f25993c79a7318d9fc71adba8383495e774746
-
SHA256
f0907b48aecc2c1fe36c2463223cab296fd3210ee822f0d3e7101cc66832ec22
-
SHA512
c8f5ee74e0c395d35843220b936d85771b01258d890c9c149a805e3e021f0238eaaeb39bc755ea61222c5082b13121cb28ff4c94c226510a2739edac32825e20
-
SSDEEP
6144:L6jmbBX0ZeLle3mNfnzrktMQiaXJI4sbN2dcc:LombB0ce3YnvXF8C4qc
Score10/10-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-