General

  • Target

    02.08.2022.exe

  • Size

    208KB

  • Sample

    240827-ksfj5aselg

  • MD5

    3a7b5aac8642f11da17347347fb6f8c1

  • SHA1

    a1a38af5efbecc1f9af3f0461743b3ee021ff79a

  • SHA256

    1fff0595de72042dcf07ee559392f31389c6ab4ab8886add752563359c97a3b7

  • SHA512

    3babcaab58d4c95c79d7963fbd42df8564c9258c8fad924cde0ad7c98d958b74c6a7edb744ba7f35bac245575cdcdeb0e4f41f5e3d45ba092915641b413cfe63

  • SSDEEP

    6144:R3LNHC8j3PHJbI36+VEra+/rV/DjwIK2INuVP5v:p3PHIErVV/DjwX27VBv

Score
10/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

C2

http://sys.sougou87.top:57580/match

Attributes
  • access_type

    512

  • host

    sys.sougou87.top,/match

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    60000

  • port_number

    57580

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCUFM0UIvEaZ3uhOD5WAFcm4r7sgQiiPLnU6VC6TFGcS9Rk4VMuuusuzAT/FanQibWrBW7Aa0L77+21SqsG4Kzldbp5LPpD6XsklCEkpLBg+gXuXf+3nmIaAu2oCBhw03zF/9nT25tyS/s3cU91/xWdE6qB6rX4nGdPWyKZE9yexQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)

  • watermark

    100000

Targets

    • Target

      02.08.2022.exe

    • Size

      208KB

    • MD5

      3a7b5aac8642f11da17347347fb6f8c1

    • SHA1

      a1a38af5efbecc1f9af3f0461743b3ee021ff79a

    • SHA256

      1fff0595de72042dcf07ee559392f31389c6ab4ab8886add752563359c97a3b7

    • SHA512

      3babcaab58d4c95c79d7963fbd42df8564c9258c8fad924cde0ad7c98d958b74c6a7edb744ba7f35bac245575cdcdeb0e4f41f5e3d45ba092915641b413cfe63

    • SSDEEP

      6144:R3LNHC8j3PHJbI36+VEra+/rV/DjwIK2INuVP5v:p3PHIErVV/DjwX27VBv

    Score
    1/10

MITRE ATT&CK Matrix

Tasks