0951889c9a57db8ff9e312aed901b8f00c35c787c5eef5699ad860b659bce693.zip
- SHA256 4ff488474dea81d49ea72667adb180541f26b956194a4967badd27051fb86cd1
Password
infected
General
- Target 0951889c9a57db8ff9e312aed901b8f00c35c787c5eef5699ad860b659bce693.zip
- Size 127KB
- Sample260512-vxlxtafs8z
- SHA256 4ff488474dea81d49ea72667adb180541f26b956194a4967badd27051fb86cd1
- MD5 42770a01e7cb5fdcba14d3802387c124
- SHA1 ff9af93582bac08e065512549535c71be872fb47
- SHA512 fd733daad0dc9a32ea82c1644fbf0a0745ab6a963152239d07777ad9af7cf6e28a3c11a1c7481adc7827b07d8055bc0953a4cff150e9ea4b6d3e3541e6db1557
- SSDEEP 3072:CYnh1k2AUL3dfnfFsnZjLJDW2KhZNBMwvA7vwFRTAIr/SdVtK:LhS2AUL1entE2wPhAIr/SdVtK
- TLSH T15ED312815CCC899DF02F71A1B084B93F50BBC185D16F546A43AE471EC3A1478BB976BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
cobaltstrike
Botnet
-
305419896
C2
-
http://101.35.214.58:80/g.pixel
Attributes
-
access_type
512
-
host
101.35.214.58,/g.pixel
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
polling_time
60000
-
port_number
80
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnCZHWnYFqYB/6gJdkc4MPDTtBJ20nkEAd3tsY4tPKs8MV4yIjJb5CtlrbKHjzP1oD/1AQsj6EKlEMFIKtakLx5+VybrMYE+dDdkDteHmVX0AeFyw001FyQVlt1B+OSNPRscKI5sh1L/ZdwnrMy6S6nNbQ5N5hls6k2kgNO5nQ7QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
-
watermark
305419896
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
File Explorer
-
0951889c9a57db8ff9e312aed901b8f00c35c787c5eef5699ad860b659bce693.zip.zip 127KB
-
0951889c9a57db8ff9e312aed901b8f00c35c787c5eef5699ad860b659bce693256KB
0951889c9a57db8ff9e312aed901b8f00c35c787c5eef5699ad860b659bce693
- SHA256 0951889c9a57db8ff9e312aed901b8f00c35c787c5eef5699ad860b659bce693
- MD5 40353c3129fab004ee19a4a489189fd1
- SHA1 c323d6c1eed4c5385986bb40f265f51c34d09e7f
- SHA512 5c1f1342d8ca43f6966e655865665384eda30bdeb40abc597a06dd28c56c207f1683be6200d14f828c984d6e7146f1fff7ec68c1cfdc560968d76c9591c61076
- SSDEEP 3072:HJwpS2NACV4qAbypuljJGnJYoTjqETdtbsnOfFwXVa/C494YJGaXM1mHnaH:HJwpYVNcn3pTdNe+WXViJ4u/H
- TLSH T1F4445A4532A03DF5ECA7D67ACA974626EFF27C664630D71F0364065B0F273A1A22E352
- MD5 SHA1 SHA512 SSDEEP TLSH