Overview

overview

10

Static

static

10

5791d47b59...01.dll

windows7-x64

3

5791d47b59...01.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5791d47b59c01cc5a9200cbaf2944b1f49401967862e3f57c50522e3e8e01c01

  • Size

    205KB

  • Sample

    240629-apavcswdnc

  • MD5

    4995bc5dc16a41f4116ae8087a76f8ee

  • SHA1

    e01dde1d19328909ce6d3aca4372697f6eca59ec

  • SHA256

    5791d47b59c01cc5a9200cbaf2944b1f49401967862e3f57c50522e3e8e01c01

  • SHA512

    51fca1a612585581720cc01a8d7d64ec4e095759b75a01c3c098716da2396eaadc3f7f0922b148c9bc457afd47ae5021eb380589468e559a9b8ea6c749df1d08

  • SSDEEP

    3072:0/QPFX1eqEfuBNSYuiM8CNj8hFsoMX0ghsJRgCD3iFw9jdUi5Qp:0/MEfuN0t8C5oFsoeRM3o0j0

Score
10/10
cobaltstrike426352781

Malware Config

Extracted

Family

cobaltstrike

Botnet

426352781

C2

http://www.jumpsrever.top:443/__utm.gif

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    www.jumpsrever.top,/__utm.gif

  • http_header1

    AAAACQAAABJ1dG1hYz1VQS0yMjAyNjA0LTIAAAAJAAAAB3V0bWNuPTEAAAAJAAAAEHV0bWNzPUlTTy04ODU5LTEAAAAJAAAAD3V0bXNyPTEyODB4MTAyNAAAAAkAAAAMdXRtc2M9MzItYml0AAAACQAAAAt1dG11bD1lbi1VUwAAABAAAAAYSG9zdDogd3d3Lmp1bXBzcmV2ZXIudG9wAAAABwAAAAAAAAAIAAAAAgAAAAZfX3V0bWEAAAAFAAAABXV0bWNjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAAAgAAAAZVQS0yMjAAAAABAAAAAi0yAAAABQAAAAV1dG1hYwAAAAkAAAAHdXRtY249MQAAAAkAAAAQdXRtY3M9SVNPLTg4NTktMQAAAAkAAAAPdXRtc3I9MTI4MHgxMDI0AAAACQAAAAx1dG1zYz0zMi1iaXQAAAAJAAAAC3V0bXVsPWVuLVVTAAAAEAAAABhIb3N0OiB3d3cuanVtcHNyZXZlci50b3AAAAAHAAAAAQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    9472

  • polling_time

    30000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDY/a9Jt2d+JikCRSFYxN4uIc19K7+GlOvCvlnCt+qnfVobWLGu0byzE9/1yGVH16QWrbJ3kPtiukITCuXzj6BNPMlGLgm0M7dnCVYLGNtR16VOre5RUkkzLWdNNTw00ExgGAlBEBQ1B2k9vPdSfbqbljsgl38QIGoDpqE+gI/VAwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    6.71092736e+08

  • unknown2

    AAAABAAAAAIAAAAPAAAAAgAAAA8AAAACAAAACgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /___utm.gif

  • user_agent

    Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MANM; MANM)

  • watermark

    426352781

Targets

    • Target

      5791d47b59c01cc5a9200cbaf2944b1f49401967862e3f57c50522e3e8e01c01

    • Size

      205KB

    • MD5

      4995bc5dc16a41f4116ae8087a76f8ee

    • SHA1

      e01dde1d19328909ce6d3aca4372697f6eca59ec

    • SHA256

      5791d47b59c01cc5a9200cbaf2944b1f49401967862e3f57c50522e3e8e01c01

    • SHA512

      51fca1a612585581720cc01a8d7d64ec4e095759b75a01c3c098716da2396eaadc3f7f0922b148c9bc457afd47ae5021eb380589468e559a9b8ea6c749df1d08

    • SSDEEP

      3072:0/QPFX1eqEfuBNSYuiM8CNj8hFsoMX0ghsJRgCD3iFw9jdUi5Qp:0/MEfuN0t8C5oFsoeRM3o0j0

    Score
    3/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks