Overview

overview

10

Static

static

10

c11a5b64c0...18.dll

windows7-x64

3

c11a5b64c0...18.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    c11a5b64c0f4f411dfee3a7a1dd56946_JaffaCakes118

  • Size

    203KB

  • MD5

    c11a5b64c0f4f411dfee3a7a1dd56946

  • SHA1

    3277285c32297ca4558d11cd106ffeea3b0b5d14

  • SHA256

    1792150e2d6a95ac7e64f4b5640b185b3c900e2f11641c3e092846eb75071c1c

  • SHA512

    e052a107489a55c20dd9e5e0768795fe5f15c4c77e1211e9cf9cdaf5d8ba54603ec9dae237297bc44f237992f5124187c69cb1ab638112a46bc5f9dd9d745b19

  • SSDEEP

    3072:9KoCXlVfe3YJfxfbP3bffuROrzHqF7l0IUaNl35G9Wuu:UZhJflr7fusnKBl0ml8Quu

Score
10/10
1998932526cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

1998932526

C2

http://thedivineshoppe.com:80/news/

Attributes
  • access_type

    512

  • create_remote_thread

    768

  • day

    7680

  • host

    thedivineshoppe.com,/news/

  • http_header1

    AAAACgAAAC1BY2NlcHQ6IHRleHQvaHRtbCwgYXBwbGljYXRpb24veGh0bWwreG1sLCAqLyoAAAAKAAAAFkFjY2VwdC1MYW5ndWFnZTogZW4tVVMAAAAKAAAAFUFjY2VwdC1FbmNvZGluZzogZ3ppcAAAAAoAAAAWSG9zdDogd3d3LmZpZGVsaXR5LmNvbQAAAAoAAAARQ29ubmVjdGlvbjogY2xvc2UAAAAHAAAAAAAAAAMAAAACAAAAA3V1PQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAABZBY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTAAAACgAAABVBY2NlcHQtRW5jb2Rpbmc6IGd6aXAAAAAKAAAAFkhvc3Q6IHd3dy5maWRlbGl0eS5jb20AAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAABwAAAAAAAAADAAAAAgAAAAN1dT0AAAAGAAAABkNvb2tpZQAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    2560

  • maxdns

    243

  • month

    256

  • pipe_name

    \\%s\pipe\msagent_%x

  • polling_time

    30000

  • port_number

    80

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCo9zGtLl1XMk5nn12hVFzrdin3amVItzzfa9hXI4uJIdqSgrUQGAqd59svpJkl7Ig1FrJkdAGdk9PjFk3KFqSZvjL7s00YJH2wS5lAVWY0sS62t/dXxK4CnnWwel/v67Bsm8XaZBLFu67TvWmLbVFecc1SOTFjms/VnlDN9m5afwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /overview/

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36

  • watermark

    1998932526

  • year

    58119

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • c11a5b64c0f4f411dfee3a7a1dd56946_JaffaCakes118
    .dll windows:5 windows x86 arch:x86

    87985676e007dd24281873bea6ef6ad7


    Headers

    Imports

    Exports

    Sections