Behavioral task
behavioral1
Sample
2023-08-23_171054708a894ebab19dd532b7f533b9_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-23_171054708a894ebab19dd532b7f533b9_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Resource
win10v2004-20230831-en
General
-
Target
2023-08-23_171054708a894ebab19dd532b7f533b9_cobalt-strike_cobaltstrike_meterpreter_JC.exe
-
Size
208KB
-
MD5
171054708a894ebab19dd532b7f533b9
-
SHA1
54b9c6eb662542496691eebc368059668f568d48
-
SHA256
dfb861c08ba5e25fb44dc4b69237d49a1fd822851cea3808b7d022306200ab9f
-
SHA512
37830bf20caa6cd8d965d699d68a5307121f030bf79d44a13960290509c20b45840483a156e826454afa9eec6f09c54af3e56e79ef4b097d0ded8a52460f9d13
-
SSDEEP
3072:pI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2Dt65jdUeY5:pIDff9D8C6XYRw6MT2DEj
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule sample cobalt_reflective_dll -
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-08-23_171054708a894ebab19dd532b7f533b9_cobalt-strike_cobaltstrike_meterpreter_JC.exe
Files
-
2023-08-23_171054708a894ebab19dd532b7f533b9_cobalt-strike_cobaltstrike_meterpreter_JC.exe.dll windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 151KB - Virtual size: 150KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ