Behavioral task
behavioral1
Sample
2023-08-22_b4894a4c78d9e5431c19457662fa3783_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-22_b4894a4c78d9e5431c19457662fa3783_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Resource
win10v2004-20230831-en
General
-
Target
2023-08-22_b4894a4c78d9e5431c19457662fa3783_cobalt-strike_cobaltstrike_meterpreter_JC.exe
-
Size
234KB
-
MD5
b4894a4c78d9e5431c19457662fa3783
-
SHA1
859b5dd231db8a962dfd7c326b7deacc2b30d40b
-
SHA256
4dbd80085386325e324921269fb32828e1ba4fc062445c58c6dca4a7ed07356e
-
SHA512
7214886099f3bedd5207fab35d2af6e676abb326eaba29ae9dac55c737ce39077ed7f29d060934e3e0fb8d8b5c57783f9c4a2d6c39a5c52f17aa4c5a132533fd
-
SSDEEP
6144:w76cI8vNm6ZHhE6DZSXhTpCkhsTYqBoDnj:q6j81lBzZSX3lI7oDnj
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule sample cobalt_reflective_dll -
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-08-22_b4894a4c78d9e5431c19457662fa3783_cobalt-strike_cobaltstrike_meterpreter_JC.exe
Files
-
2023-08-22_b4894a4c78d9e5431c19457662fa3783_cobalt-strike_cobaltstrike_meterpreter_JC.exe.dll windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 158KB - Virtual size: 158KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ