General
-
Target
d1f629cc94539f892791f43029e05f1b_JaffaCakes118
-
Size
2.5MB
-
Sample
241207-mff18sykcs
-
MD5
d1f629cc94539f892791f43029e05f1b
-
SHA1
5d625aee79fd9c6a763eec76768c7345429f570d
-
SHA256
efc8e2ea08f1774fb8f3d141eb1bb951c96c6c822e2bee507e8d3b6126126eb5
-
SHA512
f08ca319299dbb2b8678152305db302480df9fb4e765e1e9b8236020468f514b20435907b9de062d9214ab5c023bbc9156af8a0d3cc9a90f826522de49f03ab6
-
SSDEEP
24576:LOJ8C0DwtQcf0ErXkSCnMsa9l919ldcVdl1Tll2KWYKdJ6clMi81s3AwHVC65:L+8C0DwbSn2MTlOHVC65
Malware Config
Extracted
cobaltstrike
426352781
http://bdda-178-159-9-214.ngrok.io:80/match
-
access_type
512
-
host
bdda-178-159-9-214.ngrok.io,/match
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
80
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCjxGb9dLg1pHRLPeY8VxaUBnECRXGXs21tuYBW9ea0XILmF/bOiH8GKIefB/B7DpO2hKdoEwY0CtFYJnc8YAsCnO1P6MtER8+S02e/IvsZi3tzSldCMKiTbEvzwFxc942s7TQNDyj0Dsl8kBPCFxhZii8zm402Xn+QSzCrutYAlQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322)
-
watermark
426352781
Extracted
cobaltstrike
0
-
watermark
0
Targets
-
-
Target
d1f629cc94539f892791f43029e05f1b_JaffaCakes118
-
Size
2.5MB
-
MD5
d1f629cc94539f892791f43029e05f1b
-
SHA1
5d625aee79fd9c6a763eec76768c7345429f570d
-
SHA256
efc8e2ea08f1774fb8f3d141eb1bb951c96c6c822e2bee507e8d3b6126126eb5
-
SHA512
f08ca319299dbb2b8678152305db302480df9fb4e765e1e9b8236020468f514b20435907b9de062d9214ab5c023bbc9156af8a0d3cc9a90f826522de49f03ab6
-
SSDEEP
24576:LOJ8C0DwtQcf0ErXkSCnMsa9l919ldcVdl1Tll2KWYKdJ6clMi81s3AwHVC65:L+8C0DwbSn2MTlOHVC65
Score10/10-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Legitimate hosting services abused for malware hosting/C2
-