Overview

overview

10

Static

static

10

b6f640a14c...18.dll

windows7-x64

1

b6f640a14c...18.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    b6f640a14cc416e366e9bf899481fd6a_JaffaCakes118

  • Size

    236KB

  • MD5

    b6f640a14cc416e366e9bf899481fd6a

  • SHA1

    168a9694917422f0bf77aa0f8c2fccfd7aefde8d

  • SHA256

    fb97a028760cf5cee976f9ba516891cbe784d89c07a6f110a4552fc7dbfce5f4

  • SHA512

    334ef0f35c8ab47013efae30f24ab5751f6cdd367624226ca77b84e8b02c342e53f4a3e19080274109194bfd4002dd63216ebd024546012a57bc21de055263d1

  • SSDEEP

    3072:CBYelJ7Rsf1I34Vc1VwXo+meRY+OJT215VFTkzWiiJ/a2UWzxYJ8jgEBVvv0:CBYelnoVewgV7QTkq/la2UW1IMVX

Score
10/10
0cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://updatesupermaster.info:443/dpixel

http://93.113.131.162:443/ga.js
Attributes
  • beacon_type

    2048

  • host

    updatesupermaster.info,/dpixel,93.113.131.162,/ga.js

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • maxdns

    255

  • pipe_name

    \\%s\pipe\msagent_%x

  • polling_time

    60000

  • port_number

    443

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCEebq+4PL5n/BCjIoX5KVAbqqzFHHELNlq/vOwCFDYDqc7O7Rmp3qTRDlidnTNAxiHdvWnEzx78We8vDU+BlvxqmygY2LJe2U65GOIJ9kyN3ItBgyaJ9Gs8TXynB5WPhafCYdsYQLSXbHlB4Q4t+J6f8ES0+0JOZpZSvPvE7Y/WQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

  • watermark

    0

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • b6f640a14cc416e366e9bf899481fd6a_JaffaCakes118
    .dll windows:5 windows x64 arch:x64

    b1acfa09fbd0e487edb4211292bbce2e


    Headers

    Imports

    Exports

    Sections