Behavioral task
behavioral1
Sample
57774b5ddf296b1552b293806c5a73aa_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
57774b5ddf296b1552b293806c5a73aa_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Resource
win10v2004-20230703-en
General
-
Target
57774b5ddf296b1552b293806c5a73aa_cobalt-strike_cobaltstrike_meterpreter_JC.exe
-
Size
205KB
-
MD5
57774b5ddf296b1552b293806c5a73aa
-
SHA1
ee17ef5b344c2fc757a20e14861d3af6bd4e7b4b
-
SHA256
1cb83e25325d2958f7e1cb4dac6222f20a1a685eee6dd3156403db3fd2755c56
-
SHA512
9439c7d3736eef734ed0c927f826ceea68354fe0ca84a73f5328d56c9b843d2cbe2b2443ca22e46f0a17df4cda54950c48db4b01c6be2e44b48067414ba9500b
-
SSDEEP
3072:pTcDRP12yEfRQ9pChao8CbDyspILxrd5MoI/keET9dsov+lXNjtUXg5Z:pTIEfKpoB8CXvpILxp5Moa5ovkdjv
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule sample cobalt_reflective_dll -
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 57774b5ddf296b1552b293806c5a73aa_cobalt-strike_cobaltstrike_meterpreter_JC.exe
Files
-
57774b5ddf296b1552b293806c5a73aa_cobalt-strike_cobaltstrike_meterpreter_JC.exe.dll windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 148KB - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ