2176-0-0x0000000000070000-0x0000000000071000-memory.dmp
- SHA256 6fbdc4fc4552d3dcbcb1ade4f07ab491fa4ded9ecf62790e31a19b1804fb5a2a
General
- Target 2176-0-0x0000000000070000-0x0000000000071000-memory.dmp
- Size 4KB
- Sample240724-13gg6szerr
- SHA256 6fbdc4fc4552d3dcbcb1ade4f07ab491fa4ded9ecf62790e31a19b1804fb5a2a
- MD5 630a60161ad8500c241dc8eb84263dd0
- SHA1 40e06b9a3b6d7a665af637dc40e0473485be7abd
- SHA512 824bef527564de65b335d4b0ffa761e97623ed97cb49143c405f5bd1a97c874324377d8e55651f360ab85c00e4ce8487b494f2d53557defe09a88080fa13773e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
cobaltstrike
C2
-
http://36.138.209.232:60443/api-gateway/jpaas-jis-coruser-server/front/coruserlogin/usernamepwd-login.jspx
Attributes
-
user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: https://zwdtuser.sh.gov.cn/uc/naturalUser/loginNew.do Accept-Encoding-V2: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
Signatures
- Cobaltstrike family
File Explorer
-
2176-0-0x0000000000070000-0x0000000000071000-memory.dmp4KB