Behavioral task
behavioral1
Sample
2023-08-22_0494d74557982d4056c4040e19a13a85_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-22_0494d74557982d4056c4040e19a13a85_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Resource
win10v2004-20230831-en
General
-
Target
2023-08-22_0494d74557982d4056c4040e19a13a85_cobalt-strike_cobaltstrike_meterpreter_JC.exe
-
Size
208KB
-
MD5
0494d74557982d4056c4040e19a13a85
-
SHA1
c8d27075f5582de6a8f2ea9479e955fc9d9c9638
-
SHA256
d4af359def89361923651a338a730d9604a754adb129c16af54fb82d6a815464
-
SHA512
f21a3ae00d57f8b641d197d64f20e008a5d9bf1f8852bada3172702902e69ce81fb01110499e1aa0dfeafce3608b2e08f7d607a8ad807c559847de3b95dc5fc1
-
SSDEEP
3072:kIqSmQaKg7qNo4K8CmBZFGhUtufrHXF8ex/9h5j9U4Q5r:DqagONo78CmDMhUtujjx/93j
Malware Config
Extracted
cobaltstrike
0
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule sample cobalt_reflective_dll -
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-08-22_0494d74557982d4056c4040e19a13a85_cobalt-strike_cobaltstrike_meterpreter_JC.exe
Files
-
2023-08-22_0494d74557982d4056c4040e19a13a85_cobalt-strike_cobaltstrike_meterpreter_JC.exe.dll windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 151KB - Virtual size: 150KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ