General
-
Target
4f473e30fc0d30299c59b6cdec174a3d80d857f319cefd096d2db4c0f17c1ab6
-
Size
1.6MB
-
Sample
240626-fkdncawdqh
-
MD5
3cdb1bc7da587e41e101e695111c219e
-
SHA1
d8082133297ec724475bb90c2dee9d8f556ca3b6
-
SHA256
4f473e30fc0d30299c59b6cdec174a3d80d857f319cefd096d2db4c0f17c1ab6
-
SHA512
7eac3d4fc97f4aa9196dd434b9e4ae4da28fd400cdbb060bacdecd74da1c077cadb4f692964f99f92b4e637eabffad58d54af424ac2e4389e0089cfc5205b2cd
-
SSDEEP
24576:VjNYKm9MMK/BC0ygfv7fsDeqmNqB26bR04gOSrcC3Z5BrBK1:VjNeWMK/BClDehNkgOSrcC3jlBK1
Static task
static1
Behavioral task
behavioral1
Sample
4f473e30fc0d30299c59b6cdec174a3d80d857f319cefd096d2db4c0f17c1ab6.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
4f473e30fc0d30299c59b6cdec174a3d80d857f319cefd096d2db4c0f17c1ab6.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
cobaltstrike
100000000
http://43.129.216.237:89/jquery-3.3.1.min.js
-
access_type
512
-
host
43.129.216.237,/jquery-3.3.1.min.js
-
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADQAAAAIAAAAJX19jZmR1aWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADwAAAA0AAAAFAAAACF9fY2ZkdWlkAAAABwAAAAEAAAAPAAAADQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
9472
-
polling_time
45000
-
port_number
89
-
sc_process32
%windir%\syswow64\dllhost.exe
-
sc_process64
%windir%\sysnative\dllhost.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCEnTkReCnoIsn7iuiZKiw+7zSficXC2GNYfNLSCKRNrAtgB8eVhhkFi/mWPW5bvcJm5pbLvDiCu64NDKEfN82c6jyv5KRAxS9Ad2Vr2t+LLvkuMdISJpTtN0bt1DkoLXZz6HaORMNm2XFToSQorHCRqP3VfKeUUpiC9vS9LbWP6wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4.234810624e+09
-
unknown2
AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/jquery-3.3.2.min.js
-
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
-
watermark
100000000
Targets
-
-
Target
4f473e30fc0d30299c59b6cdec174a3d80d857f319cefd096d2db4c0f17c1ab6
-
Size
1.6MB
-
MD5
3cdb1bc7da587e41e101e695111c219e
-
SHA1
d8082133297ec724475bb90c2dee9d8f556ca3b6
-
SHA256
4f473e30fc0d30299c59b6cdec174a3d80d857f319cefd096d2db4c0f17c1ab6
-
SHA512
7eac3d4fc97f4aa9196dd434b9e4ae4da28fd400cdbb060bacdecd74da1c077cadb4f692964f99f92b4e637eabffad58d54af424ac2e4389e0089cfc5205b2cd
-
SSDEEP
24576:VjNYKm9MMK/BC0ygfv7fsDeqmNqB26bR04gOSrcC3Z5BrBK1:VjNeWMK/BClDehNkgOSrcC3jlBK1
Score10/10 -