Behavioral task
behavioral1
Sample
988d0cc73590a0768199453bb1aa0728_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
988d0cc73590a0768199453bb1aa0728_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Resource
win10v2004-20230824-en
General
-
Target
988d0cc73590a0768199453bb1aa0728_cobalt-strike_cobaltstrike_meterpreter_JC.exe
-
Size
234KB
-
MD5
988d0cc73590a0768199453bb1aa0728
-
SHA1
1fb81aa3113e369e4e9e53ef17bf504ff000cf19
-
SHA256
662e7736f814ec4783b876370874560c86ad6a6deb78f6cd7b8a93eaa8c2ead4
-
SHA512
18896bc365409ae312f5b6466cce5403a6648fc85bd046df2ea516e088fa4c0c5422f1378574174644393773fd7e53c0a5cfab5424276e263687a2a31ca2ed52
-
SSDEEP
3072:eFN9waSnxcCnHIZHhrpRsNcKWv1sK7m2Wq+YQhs2Flgez4YbDNFVpjFUG5T:eFNKxc0HIZHiQ1lCq+YQm2zEoDNFTj
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule sample cobalt_reflective_dll -
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 988d0cc73590a0768199453bb1aa0728_cobalt-strike_cobaltstrike_meterpreter_JC.exe
Files
-
988d0cc73590a0768199453bb1aa0728_cobalt-strike_cobaltstrike_meterpreter_JC.exe.dll windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 158KB - Virtual size: 158KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ