Behavioral task
behavioral1
Sample
9f9ea16ef2d90bb3833ed0337f21b2f0_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
9f9ea16ef2d90bb3833ed0337f21b2f0_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Resource
win10v2004-20230703-en
General
-
Target
9f9ea16ef2d90bb3833ed0337f21b2f0_cobalt-strike_cobaltstrike_meterpreter_JC.exe
-
Size
218KB
-
MD5
9f9ea16ef2d90bb3833ed0337f21b2f0
-
SHA1
6d7cac15a2bd28415cb96776a32e777bcf14a677
-
SHA256
49d8ca0200bf2bb28849eb358d525f1ed4d35e3049024697177a5fceea5e4705
-
SHA512
2eb2a942b9d467762c0cedef330c3d82df4d07c202d60602cb418a4a4f77b83981959e6eb0d0acfb6c1d4b8ee533f8c0d911a2d9918e40e9454d59c3f0ba1838
-
SSDEEP
3072:GPyrp5vzSUOjVfzwAHvGJ8IYz6wnlIUjAP3QxspYbuvDGhjZUi5n:GPUPOpfzwAHvY8Ie66Imgg5buvDaj
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule sample cobalt_reflective_dll -
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9f9ea16ef2d90bb3833ed0337f21b2f0_cobalt-strike_cobaltstrike_meterpreter_JC.exe
Files
-
9f9ea16ef2d90bb3833ed0337f21b2f0_cobalt-strike_cobaltstrike_meterpreter_JC.exe.dll windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 153KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ