jaffacakes118_b9b17424638fe92df53f24cf420c9fa7c7da54acf46e6f83443e0440168fc0f6.bin
- SHA256 b9b17424638fe92df53f24cf420c9fa7c7da54acf46e6f83443e0440168fc0f6
General
- Target jaffacakes118_b9b17424638fe92df53f24cf420c9fa7c7da54acf46e6f83443e0440168fc0f6.bin
- Size 208KB
- Sample260910-vjradael4w
- SHA256 b9b17424638fe92df53f24cf420c9fa7c7da54acf46e6f83443e0440168fc0f6
- MD5 bc0394264b3a3086465748d16cf864f6
- SHA1 953505babbcd8e11fda6e8fbd5ca7eecbf95144d
- SHA512 ef001d6503dc642a1db1c0c8347ba607c91fbf27cf2a53e7dae14534a9f52047c53ae958cd1d5774720522cf5ae6ea0a2010899fedfef806174a6b797f3be84b
- SSDEEP 3072:CmwbQmlDBQ4uX2gbklNI4OCyLd0M6oS5kB4U7yG4OPemZ8Nnj+Da4OOHwqX8cqc:CmEzBXM2gbkc4XyL2tH5uF7VIMrOOf5p
- TLSH T16324EF507107E8833776B970E4EBBC487ED6CA6DD342E084F0A9BDC7D680A9D8CD6690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
cobaltstrike
Botnet
-
100000
C2
-
http://155.94.170.180:80/CaoNajLBo/VtNeww11312/
Attributes
-
access_type
512
-
host
155.94.170.180
-
http_header1
AAAACgAAAEBBY2NlcHQ6IGltYWdlL2dpZiwgaW1hZ2UveC14Yml0bWFwLCBpbWFnZS9qcGVnLCBpbWFnZS9wanBlZywgKi8qAAAACgAAABZBY2NlcHQtTGFuZ3VhZ2U6IGVuLWVuAAAACgAAABZDb25uZWN0aW9uOiBLZWVsLUFsaXZlAAAACgAAABdDYWNoZS1Db250cm9sOiBuby1jYWNoZQAAAAcAAAAAAAAACwAAAAEAAAAML1V0V09RUFExMzIvAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAEBBY2NlcHQ6IGltYWdlL2dpZiwgaW1hZ2UveC14Yml0bWFwLCBpbWFnZS9qcGVnLCBpbWFnZS9wanBlZywgKi8qAAAACgAAABZBY2NlcHQtTGFuZ3VhZ2U6IGVuLWVuAAAACgAAABZDb25uZWN0aW9uOiBLZWVsLUFsaXZlAAAACgAAABdDYWNoZS1Db250cm9sOiBuby1jYWNoZQAAAAcAAAAAAAAACwAAAAEAAAAML1V0V09RUFExMzIvAAAADAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
6400
-
polling_time
30000
-
port_number
80
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCIf8O2+UCfI1puQK7qbUGsOcxkba0ujT8VsBJuL5DACDg/dGGF/tt1VJUossc/D6SXtQIfgIkdx/FDaiEj8nnlda/viG7hSCSFA5SQcnCXD+QkW8/8WAqmHHnJXNPkIqflSHJF5AM9Q0fTTcxBzaZI446Ut8G8btn1folLWDA3mQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/CWonaJLAo/VtneWW11313/
-
user_agent
Mozilla/5.0 (compatible; MSIE 6.0;Windows NT 5.1)
-
watermark
100000
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
File Explorer
-
jaffacakes118_b9b17424638fe92df53f24cf420c9fa7c7da54acf46e6f83443e0440168fc0f6.bin208KB