cobaltstrike | a38ae87288152300753ae3e741ed111fc4628d022206ff944f2795e9cc2ed419

Sharing

Copy URL Twitter E-mail

General

Target

a38ae87288152300753ae3e741ed111fc4628d022206ff944f2795e9cc2ed419
Size

205KB
MD5

08eae75df39d9f85e10d6f0e7999409d
SHA1

feb1444e5543a158f56f48f22542933278f74642
SHA256

a38ae87288152300753ae3e741ed111fc4628d022206ff944f2795e9cc2ed419
SHA512

95e7faf24b232b51c2ccd8f2dc2103bc8fe4abf5e8f49e6ff757fb550d2471f7297415b7569d5747afa22d9b8369b524ea7c20095e53d4969940bca17a9cb1ea
SSDEEP

3072:/YAwUMuFAcLilzWYpMfsr0tEu9G2VFNzP54C0s/olUtEL5RuN:wAudTCfsgGgDKPs/oFA

Score

10^/10

cobaltstrike

Malware Config

Signatures

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
sample	cobalt_reflective_dll

Cobaltstrike family
cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a38ae87288152300753ae3e741ed111fc4628d022206ff944f2795e9cc2ed419

Files

a38ae87288152300753ae3e741ed111fc4628d022206ff944f2795e9cc2ed419
.dll windows x86

0bc418575efc832b308d227b31192688

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

UpdateProcThreadAttribute
HeapFree
GetProcessHeap
CreateRemoteThread
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
LoadLibraryA
ProcessIdToSessionId
DuplicateHandle
InitializeProcThreadAttributeList
WriteProcessMemory
CreateThread
GetThreadContext
SetThreadContext
FreeLibrary
VirtualFree
Thread32First
Thread32Next
SetLastError
OpenThread
CreateToolhelp32Snapshot
GetVersionExA
SuspendThread
ResumeThread
PeekNamedPipe
WaitNamedPipeA
SetNamedPipeHandleState
LocalAlloc
LocalFree
GetComputerNameA
Process32First
TerminateProcess
HeapAlloc
ExitProcess
DeleteProcThreadAttributeList
VirtualProtect
FindNextFileA
MoveFileA
FindClose
CopyFileA
FindFirstFileA
FileTimeToSystemTime
GetFileAttributesA
ExpandEnvironmentStringsA
GetLogicalDrives
SystemTimeToTzSpecificLocalTime
GetFullPathNameA
GetModuleHandleA
CreateNamedPipeA
GetProcAddress
ReadFile
GetCurrentThread
ConnectNamedPipe
GetCurrentProcess
CloseHandle
GetFileTime
GetCurrentDirectoryA
CreatePipe
GetCurrentDirectoryW
GetLastError
GetStartupInfoA
SetCurrentDirectoryA
FlushFileBuffers
DisconnectNamedPipe
MultiByteToWideChar
CreateProcessA
OpenProcess
WriteFile
SetFileTime
WaitForSingleObject
SetEnvironmentVariableW
CreateFileA
Sleep
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
VirtualQuery
GetModuleFileNameW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
HeapSize
IsValidCodePage
GetCPInfo
DebugBreak
RaiseException
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCurrentProcessId
GetOEMCP
GetLocalTime
GetACP
Process32Next
GetTickCount
GetEnvironmentStrings
FreeEnvironmentStringsA
SetFilePointer
GetFileType
GetModuleHandleW
DeleteFileA
CreateDirectoryA
RemoveDirectoryA
GetCurrentThreadId
GetCommandLineA
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetHandleCount

advapi32

RegEnumValueA
CloseServiceHandle
OpenProcessToken
CreateProcessWithLogonW
DeleteService
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
LogonUserA
CheckTokenMembership
FreeSid
RevertToSelf
AllocateAndInitializeSid
DuplicateTokenEx
LookupAccountSidA
GetTokenInformation
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegEnumKeyA
CreateProcessAsUserA
RegOpenCurrentUser
RegOpenKeyExA
GetUserNameA
AdjustTokenPrivileges
ControlService
QueryServiceStatusEx
ImpersonateNamedPipeClient
ImpersonateLoggedOnUser
LookupPrivilegeValueA
OpenThreadToken
OpenServiceA
OpenSCManagerA
QueryServiceStatus
CreateProcessWithTokenW
StartServiceA
CreateServiceA

wininet

HttpQueryInfoA
InternetQueryDataAvailable
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetCloseHandle
InternetQueryOptionA
InternetConnectA

ws2_32

ntohs
connect
htons
socket
accept
send
gethostname
inet_ntoa
WSAStartup
WSACleanup
gethostbyname
htonl
ntohl
listen
__WSAFDIsSet
bind
recv
shutdown
WSAGetLastError
select
ioctlsocket
inet_addr
closesocket

dnsapi

DnsFree
DnsQuery_A

iphlpapi

GetIfEntry
GetIpAddrTable

secur32

LsaCallAuthenticationPackage
LsaConnectUntrusted
LsaLookupAuthenticationPackage

Exports

Exports

_ReflectiveLoader@4

Sections

.text
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0bc418575efc832b308d227b31192688

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

wininet

ws2_32

dnsapi

iphlpapi

secur32

Exports

Exports

Sections

.text Size: 147KB - Virtual size: 147KB

.rdata Size: 40KB - Virtual size: 40KB

.data Size: 9KB - Virtual size: 63KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 147KB - Virtual size: 147KB

.rdata
Size: 40KB - Virtual size: 40KB

.data
Size: 9KB - Virtual size: 63KB

.reloc
Size: 8KB - Virtual size: 7KB