General
- Target f5cf0f9c5371456e920ecb3df5b336b15aa73bce33bc8fe0940fd8de0c2c7cf3
- Size 289KB
- Sample240724-kstrrazhme
- SHA256 f5cf0f9c5371456e920ecb3df5b336b15aa73bce33bc8fe0940fd8de0c2c7cf3
Score
10/10
Malware Config
Extracted
Family
-
cobaltstrike
Botnet
-
987654321
C2
-
http://ns1.returnwrong.com:53/cm
-
http://ns2.returnwrong.com:53/pixel
Attributes
-
access_type
512
-
beacon_type
256
-
host
ns1.returnwrong.com,/cm,ns2.returnwrong.com,/pixel
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
polling_time
60000
-
port_number
53
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCgFbf4UV57Ze7H9b59MIQ9tF6teRocIp43A9BoFHatwSDFe9PsCIAEQzts3GiqDtX+JSgIAWS0blT2pkMCU2eAwFKAMLwxnxlo3X8CnXF8+cD6HWwj2OBl8WyHVQ5d2nmQxCkq4a7g9fFx0igykOa2cm+TY7515ZkqtVUkeiBSQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
watermark
987654321
Targets
-
- Target f5cf0f9c5371456e920ecb3df5b336b15aa73bce33bc8fe0940fd8de0c2c7cf3
- Size 289KB
- SHA256 f5cf0f9c5371456e920ecb3df5b336b15aa73bce33bc8fe0940fd8de0c2c7cf3
Score10/10-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.