jaffacakes118_1eb25455e3bd0d14e2f7ef1443456a82.bin.decrypted
- SHA256 d4161f9b69b71fc66e4bad316beca6fc737b958a0e0e6faca5ac4f80d521851e
General
- Target jaffacakes118_1eb25455e3bd0d14e2f7ef1443456a82.bin.decrypted
- Size 255KB
- Sample261006-jeaahsty7r
- SHA256 d4161f9b69b71fc66e4bad316beca6fc737b958a0e0e6faca5ac4f80d521851e
- MD5 f0cff16be682157ed82e78cfacc53733
- SHA1 e3b51a01ba45b24cde1a2eec8c7032831f7fdea5
- SHA512 180f3e54170ff60b7ef6bd6327aeac87bb7505c58a12b150271b9c9c0d6d2ff73cabe16c8e72fc64c38c456df80e7481eee23d8a0491f9577e79db635269e3fc
- SSDEEP 6144:LOre8kPd0EQIp1s4/q3C1BIAFzm50xJKkGexgX:LWIPd0ENbsEq3C1BHFq5CKbe
- TLSH T12C44CF033B713C99FE07E4348DDB28556E652EE71B99DB2212E10419ACCFB89E99CD13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
cobaltstrike
Botnet
-
1359593325
C2
-
http://wnx��A���1�jr��E<.�Yz[��᭙-p�� � ��{Д;�nFw~���� �����#ӒX�Өf O+�PU�� ��N v�Oc&��(Ⱦ��w�@�L*���T�5M<h��_ߧ4hlP^�������U �y :2232665665���� �����#ӒX�Өf O+�PU�� ��N v�Oc&��(Ⱦ��w�@�L*���T�5M<h��_ߧ4hlP^�������U �y
-
http://gatewan.com:443/c/msdownload/update/others/2021/10/8PaDBDxLtokI3eH8
Attributes
-
access_type
512
-
beacon_type
2048
-
host
gatewan.com
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAABAAAAARSG9zdDogZ2F0ZXdhbi5jb20AAAAHAAAAAAAAAA8AAAANAAAAAQAAAAQuY2FiAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAcAAAAAAAAADwAAAA0AAAACAAAABVNTSUQ9AAAAAQAAABA7IGhnPXJ1aGZuODdobm5qAAAABgAAAAZDb29raWUAAAAHAAAAAQAAAA8AAAANAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
3584
-
polling_time
60000
-
port_number
443
-
sc_process32
%windir%\syswow64\powercfg.exe
-
sc_process64
%windir%\sysnative\powercfg.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCX87NhCtfBBWtqPWe4lmEA5YVnbe2Ds/0UeIEMDtppNZOB48YnwKtHRya8SPa06wwcN17xfiuVMUNw47PXQl66J++puwBkRbflPZ0xp3q8Uhg7+N6q3V5HjrNBkqPyxBdl7EcW+j8uCC+Ok5rpveD2k4ugVaHJsR8wNahHu/2WbQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/c/msdownload/update/others/2021/10/PgYhuOrusIUfanT8aJ
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
-
watermark
1359593325
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
File Explorer
-
jaffacakes118_1eb25455e3bd0d14e2f7ef1443456a82.bin.decrypted255KB