General
-
Target
ba1864508ced0ea824761d904baacc8aca9f0c5833ecd25c90cd61bd2c384864
-
Size
289KB
-
Sample
240628-rpzxxstgnd
-
MD5
e3f740b092a9876c9ba995b3347f1699
-
SHA1
fa83a1d81f5337c8bbf5f9f0ab6fe17aa7f5c569
-
SHA256
ba1864508ced0ea824761d904baacc8aca9f0c5833ecd25c90cd61bd2c384864
-
SHA512
6212014e217b0bfde7a33fd78cb443bad1131143c418e35501b655e125f8d40c32cfe810c42a4ce7b0f2dd6cecfa9dc438d07baefe7738512cdb672cd99f4b86
-
SSDEEP
6144:sHkizqzShGOjj5HpNEmc0tsyd5UvvdkNgHHHHHHHH0:sHkieziDPppNBc0t1CjHHHHHHHH0
Static task
static1
Behavioral task
behavioral1
Sample
ba1864508ced0ea824761d904baacc8aca9f0c5833ecd25c90cd61bd2c384864.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ba1864508ced0ea824761d904baacc8aca9f0c5833ecd25c90cd61bd2c384864.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
cobaltstrike
987654321
http://192.168.89.128:2323/push
-
access_type
512
-
host
192.168.89.128,/push
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
2323
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDVIIrQvTFgc4W/eJBjSCFgXp2HGnHcEfN4Ke4j9kti8cYi3KLGdp5WsmuJIftJ7PzDpBL+3M1sTPuI33pKKwWfXvQjYHJbNl2uFqL5hKPRu6+qU1LoeZgfIrx2YEo7f4D3svAMdx1lQF3a00PSEQKsWNJzZbZII9UsPibfbZbLtwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MATM)
-
watermark
987654321
Targets
-
-
Target
ba1864508ced0ea824761d904baacc8aca9f0c5833ecd25c90cd61bd2c384864
-
Size
289KB
-
MD5
e3f740b092a9876c9ba995b3347f1699
-
SHA1
fa83a1d81f5337c8bbf5f9f0ab6fe17aa7f5c569
-
SHA256
ba1864508ced0ea824761d904baacc8aca9f0c5833ecd25c90cd61bd2c384864
-
SHA512
6212014e217b0bfde7a33fd78cb443bad1131143c418e35501b655e125f8d40c32cfe810c42a4ce7b0f2dd6cecfa9dc438d07baefe7738512cdb672cd99f4b86
-
SSDEEP
6144:sHkizqzShGOjj5HpNEmc0tsyd5UvvdkNgHHHHHHHH0:sHkieziDPppNBc0t1CjHHHHHHHH0
Score10/10 -