Overview

overview

10

Static

static

10

aa519718ab...94.dll

windows7-x64

1

aa519718ab...94.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    aa519718abe203c0594e3d9a636a1b0944b30ae84edec2c8357e0e16a717ee94

  • Size

    257KB

  • MD5

    f5007e92ac90d524fe6cef500428bae6

  • SHA1

    935a3118f84acdc76bbec718864fd28b723891d3

  • SHA256

    aa519718abe203c0594e3d9a636a1b0944b30ae84edec2c8357e0e16a717ee94

  • SHA512

    2092e0be8ae734fc4873e09e5a64efaaf24e1aaa5d9df403c3dfdfd5d7bb0fc5d69a96c708276ac5cc0035491068a29d4d7cee8a2d12ea1f3281b8f0d1572ec5

  • SSDEEP

    3072:RsYckn3Xzq4IDwSK6Mbn/gprlJwJNJsCwQTIfXouPruOOTRYE9BQYJerConI:RsYwjwUGIprlJweGTIDjhOTRFQ88I

Score
10/10
999999cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

999999

C2

http://150.158.81.5:8888/verchk/verchk_

Attributes
  • access_type

    512

  • host

    150.158.81.5,/verchk/verchk_

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAABAAAAAcSG9zdDogdHJhbnNhY3QubmV0c2FyYW5nLmNvbQAAAAcAAAAAAAAADQAAAAEAAAAELnBocAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAABAAAAAcSG9zdDogdHJhbnNhY3QubmV0c2FyYW5nLmNvbQAAAAcAAAAAAAAADQAAAAIAAAA2aHR0cHM6Ly90cmFuc2FjdC5uZXRzYXJhbmcuY29tL3ZlcmNoay92ZXJjaGsucGhwP2RhdGE9AAAABgAAAAdSZWZlcmVyAAAABwAAAAEAAAANAAAAAQAAAAQucGhwAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    GET

  • jitter

    5120

  • polling_time

    50000

  • port_number

    8888

  • sc_process32

    %windir%\syswow64\gpupdate.exe

  • sc_process64

    %windir%\sysnative\gpupdate.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCAIR1Jj81Lp7ATMWnWXrumzNa8kI9es1ikdSx/vpYHSDaqpDU7Q6I+398cBlOdWah89GLfyvy+jJmNSOq1NuMawZa54e8gOxJGQfGzTrtBkmyllk9KeB5jhgv9U+OuKO/6YEIEZv+7AKhqcZZD/EFkvncwyG0njxZimOR1lISa2wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown3

    1.610612736e+09

  • uri

    /verchk/data_

  • user_agent

    TrueUpdate 3.5

  • watermark

    999999

Signatures

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • aa519718abe203c0594e3d9a636a1b0944b30ae84edec2c8357e0e16a717ee94
    .dll windows:5 windows x64 arch:x64

    bd0c83d6821617ef54f9b1da8449e4a3


    Headers

    Imports

    Exports

    Sections