Behavioral task
behavioral1
Sample
2023-08-22_899377f6b017d9e84e203dbcfa042743_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-22_899377f6b017d9e84e203dbcfa042743_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Resource
win10v2004-20230831-en
General
-
Target
2023-08-22_899377f6b017d9e84e203dbcfa042743_cobalt-strike_cobaltstrike_meterpreter_JC.exe
-
Size
218KB
-
MD5
899377f6b017d9e84e203dbcfa042743
-
SHA1
6309ba9803ecefa93ffeb5066ef15dd3769bdf98
-
SHA256
ae621a54abe4cf7ea3146534fa479c4840d092152dd3bf9436a52ae80f82140b
-
SHA512
ddeb29d12cca6550e5b68094e2b8dd575e818acc76b7d2ad7d243a7be9f32ac72854e5707e619277a84f41d0678cf22d95e4cb7f28d664c4277cf042c77e6dd4
-
SSDEEP
3072:JdxuVlWPzXSRSVY67ljk8Ie+D4MbFgMuHIaCMm+FJU+v1jlU/t5Y:JdxuVASROn7lQ8IFxbLKFdFJzdj
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule sample cobalt_reflective_dll -
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-08-22_899377f6b017d9e84e203dbcfa042743_cobalt-strike_cobaltstrike_meterpreter_JC.exe
Files
-
2023-08-22_899377f6b017d9e84e203dbcfa042743_cobalt-strike_cobaltstrike_meterpreter_JC.exe.dll windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 153KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ