Overview

overview

10

Static

static

3

4363463463...63.exe

windows11-ltsc_2024-x64

Resubmissions

14/10/2026, 00:50

261014-a61gcady2w10

14/10/2026, 00:49

261014-a6k2nadx9110

04/10/2026, 22:55

261004-2wkfxsyfpf10

04/10/2026, 22:41

261004-2mejbaszax10

03/10/2026, 15:10

261003-sj2p1aszey10

27/09/2026, 08:25

260927-ka9egsts4j10

27/09/2026, 08:18

260927-j7p7fas16n10

26/09/2026, 10:25

260926-mf8fgsdd8610

26/09/2026, 10:13

260926-l851ds1djg10

24/09/2026, 12:57

260924-p6wkqathrd10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4363463463464363463463463.exe.bin
  • Size 10KB
  • Sample261014-a6k2nadx91
  • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
cobaltstrikediscordratlumma987654321backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratrevoked_codesignrootkitstealertrojan

Malware Config

Extracted

Family

  • cobaltstrike

Botnet

  • 987654321

C2

  • http://115.190.250.28:5521/j.ad

Attributes
  • access_type

    512

  • host

    115.190.250.28

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    60000

  • port_number

    5521

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCIqrxhTCeMCoWOTHnOosASxjhtpfg1Tg/x/OH5jAoeXy+GbFHxSN8BCCAjCCKUDpQQPSzDbE9+frrCh2G2vXaWfLK7u5yBzxRLG0PeDeAHjmdMpWRLCmepNsSHd4OeGJ2/X7pw8Ije9kzkpvsefl99dk7Ga6eQAXeiT4jBZc/07wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)

  • watermark

    987654321

Extracted

Family

  • discordrat

Attributes
  • discord_token

    MTMxNTQxMDg0NDg3NTQ4OTI4MA.Gx5ptK.HY1OYsjGMP1MsOoyD2E7T9pCvkfHTdOPozmb_c

  • server_id

    1315411300192616569

Extracted

Family

  • lumma

C2

  • https://covvercilverow.shop/api

  • https://surroundeocw.shop/api

  • https://abortinoiwiam.shop/api

  • https://pumpkinkwquo.shop/api

  • https://priooozekw.shop/api

  • https://deallyharvenw.shop/api

  • https://defenddsouneuw.shop/api

  • https://racedsuitreow.shop/api

  • https://roaddrermncomplai.shop/api

Targets

    • Target
      4363463463464363463463463.exe.bin
    • Size 10KB
    • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoor987654321defense_evasiondiscoveryexecutioncobaltstrikediscordratlummapersistenceprivilege_escalationratrevoked_codesignrootkitstealertrojan

    • Family: Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Family: Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Family: Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Downloads MZ/PE file

    • Signed with revoked ConnectWise certificate

      Binary is signed using a ConnectWise certificate revoked for key compromise.

      revoked_codesign

    • Executes dropped EXE

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion

    • Suspicious use of NtCreateThreadExHideFromDebugger

      defense_evasion
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks