General
-
Target
bb3079d1cd8286030cace15cf99757606621b21509f04b3c87d28652697ccaea.zip
-
Size
130KB
-
Sample
240816-z5218axeqh
-
MD5
fd41411c7b3358fe9dd7f6f325e9283d
-
SHA1
cfab939f01fabac9dd8af20981d58c166dba8529
-
SHA256
524c271838780150965d29aee535b13dbf1e49d291f7afe7fbf96317e7414317
-
SHA512
c9d0e3e4f74061981956838866515ae4675fdeaf3f62ed60e05641d0fa2de844bb4711e7404f8e544e496c1c11a647c8b11133e640f8d1acd4f55d25c3eb83fa
-
SSDEEP
3072:Lej5R7JRTAaoIwoJsbwusQo/xCJNFicaxX2yZnW:W7XTAaLwms8ushZcwcaxNZW
Malware Config
Extracted
cobaltstrike
391144938
http://192.168.91.131:80/ptj
-
access_type
512
-
host
192.168.91.131,/ptj
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
80
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCGoYhIx61P0U82pw37ja9ImqjsDN7Txx813jEm0uHg7o68exZWC0Ab/AaU0KkADSaFXpFPRYEETcOOEv5PT2bsVFIyxA5zwrI9SdEhn7hlzMgDAczAxSEAJNzWk9zCNO3QrCvfKQHbxDdPBp0IDmaSn3iWH8FEJOlzlW6hmAGz5QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.4; .NET4.0C)
-
watermark
391144938
Extracted
cobaltstrike
0
-
watermark
0
Targets
-
-
Target
bb3079d1cd8286030cace15cf99757606621b21509f04b3c87d28652697ccaea
-
Size
272KB
-
MD5
385f363cbc844351eb83e01367749734
-
SHA1
64627b115fe9a607c538b14c9f69a2b5b50e4117
-
SHA256
bb3079d1cd8286030cace15cf99757606621b21509f04b3c87d28652697ccaea
-
SHA512
58a6e13629e3f8066cf1dd92798c3f8aae6ce9cff6bc8bb615dd30617fa6da26e4267118558c0dcc8a6a60b8db18eeaf8c92ba54812a7b63425f12e65f8903bd
-
SSDEEP
3072:rzbINhWl+CIbfqqEVxtfg8jtfDCJS4l9JTFyG+JteEzCnL7zdGIkfhUYJF6vzHk2:rzbUWootfDCvT4ZTXzCL4Ik5UDhrKM
Score10/10-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-