b2b139260698ba868fb71c7fbd071cb9dbe9bcb2ca4e1d3276481861890281af.zip
- SHA256 314299548cc4d0010b0d954536b238e49c284cbab47a01e863e110609e98f77a
Password
infected
General
- Target b2b139260698ba868fb71c7fbd071cb9dbe9bcb2ca4e1d3276481861890281af.zip
- Size 166KB
- Sample260916-tc74waserc
- SHA256 314299548cc4d0010b0d954536b238e49c284cbab47a01e863e110609e98f77a
- MD5 c3fda8b3120c20cd1865af9aa6250891
- SHA1 978ad7b314799d157e0071ef318195c891478893
- SHA512 7ecb4a07522b27d399fd05bb714b76bf42a997129b88b8e71ceb64c7cef6ec70bbbaf6551f5fa9086571dee32eb30dfcac533c0156be6512547f48ae14f86ea4
- SSDEEP 3072:5VIWgqxYo15CEwKyQeaewmIqZxRowgeoMSMiGnKnjMA1Y1xDZVeTqs:LFgqz15C9KRBewmTZsa9SHExt2
- TLSH T11AF312F50451B6E843D16FE225E2787BC1C15066622E888A2E89EC302B7CDF65DC6BDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
cobaltstrike
Botnet
-
987654321
C2
-
http://141.255.162.234:37422/__utm.gif
Attributes
-
access_type
512
-
beacon_type
2048
-
host
141.255.162.234
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
37422
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCPqqT/7B246dBCi5RsGTgsDcY4+XdEccTiRpwnyp5Ru3qDZJcHOBzANR2aBZ9oUOb9v/7aL16y6nrxKIYEI9Ry8WUDActeh4lgRtUCCPX3CtDbfflNe5q00mZdNQtQA7s0a9MWaC/SCaIMhmmarEjwDrScUxayhaaEXhKN4rhOIQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; MDDCJS)
-
watermark
987654321
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/b2b139260698ba868fb71c7fbd071cb9dbe9bcb2ca4e1d3276481861890281af
File Explorer
-
b2b139260698ba868fb71c7fbd071cb9dbe9bcb2ca4e1d3276481861890281af.zip.zip 166KB
-
b2b139260698ba868fb71c7fbd071cb9dbe9bcb2ca4e1d3276481861890281af.sys 312KB
b2b139260698ba868fb71c7fbd071cb9dbe9bcb2ca4e1d3276481861890281af
- IMPHASH 9839e453951a3c180ac6efabc5de9332
- SHA256 b2b139260698ba868fb71c7fbd071cb9dbe9bcb2ca4e1d3276481861890281af
- MD5 04947f9fbac324c43758dbf459cf2fa2
- SHA1 c5f7290933478b421a7be25fd8031e7824b0ba17
- SHA512 6d095d32dd19fc00ba6737f11b998ade7a41c26c9addfa4280a3a61a7bd343ef96e7621a1c31e4db5d6ebca629ac5d289c61098f5ab3decde4cf93dcec13a8ba
- SSDEEP 6144:pj/7Qsrm8pU99tkS1eTbqrerouvFPwgdOYo:pvLPw9tZU+4FPw/Y
- TLSH T125646B59B3A078F5E8A7C239CA57461AEFF27C594370D74F07640A6A2F237A1623D312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
331776
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ntoskrnl.exe
RtlInitUnicodeString
ExAllocatePoolWithTag
ExFreePoolWithTag
ObfDereferenceObject
ZwCreateFile
ZwQueryInformationFile
ZwReadFile
ZwClose
ZwCreateSection
ZwMapViewOfSection
ZwOpenProcess
PsLookupThreadByThreadId
KeInitializeApc
KeInsertQueueApc
ZwQuerySystemInformation
_wcsicmp
DbgPrintEx
KeDelayExecutionThread
PsCreateSystemThread
PsTerminateSystemThread
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
ZwSetInformationFile
ZwWriteFile
ZwCreateKey
ZwOpenKey
ZwSetValueKey
IoCreateDriver
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
772B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
302KB
Virtual Size
301KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
228B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
922B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=1, id=259, version=35222,
count=3, id=257, version=35222,
count=29, id=1, productName=Unmarked objects,
count=2, id=260, version=36252,
count=1, id=258, version=36252,