Overview

overview

10

Static

static

10

230afcc9ef...JC.dll

windows7-x64

3

230afcc9ef...JC.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    230afcc9efa199exeexe_JC.exe

  • Size

    200KB

  • MD5

    230afcc9efa19969a44a34d9c4ef6819

  • SHA1

    5d9a660d56d4cb03092942e3c524091fcc3379a5

  • SHA256

    5736b938114bd6be0e67572e2258330a811153342f1bf04605641fb3b0466c96

  • SHA512

    3120922720d38b82872220e3ee36a8df37a5a58d7cd7cce68b5318297d0f1c6c431ca69aba829582f36c8759f074e9cd28cbccd84dacf95b8d15f5bb05aef0c5

  • SSDEEP

    3072:47U9uXWusP38CWlTR65tk4+k8v7FsZWjEUz+Z5wo:NeWue8CWNA5tQ7Fzjy8o

Score
10/10
1234567890cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

1234567890

Attributes
  • beacon_type

    4096

  • http_header1

    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • polling_time

    10000

  • port_number

    4444

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCb5Rh5nEpxS4W2l+uDub1GusXP5sHajP39yEXRUb8NvfJ3ZHKapB7f6IZFLFyjCrIaAUdUASmFDcdytiq4sW0/osoKP+0ORjaUaeUvhZrjCHDWuBphb6ZZA8AJZKCv2U3Lc1a7ftKfPPLONkf1Gur1v5PFT57Hmi+lOyuOE8sSxwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • watermark

    1234567890

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike family
    cobaltstrike
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 230afcc9efa199exeexe_JC.exe
    .dll windows x86

    e1a4d247b17efc22a4a7b36cfb5221ae


    Headers

    Imports

    Exports

    Sections