vidar | 2023-08-26_c697c5a35ce4c741fab6609c4ecbc9d0_cobalt-strike_mafia_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

2023-08-26_c697c5a35ce4c741fab6609c4ecbc9d0_cobalt-strike_mafia_JC.exe
Size

589KB
MD5

c697c5a35ce4c741fab6609c4ecbc9d0
SHA1

ba9d79e74959842574ca26d8fd45bee20bf8d0ee
SHA256

5fb24ff4769160b3dfbef85aa933f6fd08bb9c024b46d8e4da1c17b0ae362dbe
SHA512

3f4f6410172543a0ffdd75f0ee5d124b3a38827f0eef937d92c30536916426d156026f236d445ad3d973e31ff24b3e889925a246cb4e7edfccfb6e00edf4f8cb
SSDEEP

12288:/usos0AcUj83OoEeg1T9U5UA0kMGTUDM31bHRPKxyh2dTbmYm0uQ:/X5BcUj839Eeg1T9U5UA0kMGTUU1VK0Z

Score

10^/10

vidar

Malware Config

Signatures

Vidar family
vidar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2023-08-26_c697c5a35ce4c741fab6609c4ecbc9d0_cobalt-strike_mafia_JC.exe

Files

2023-08-26_c697c5a35ce4c741fab6609c4ecbc9d0_cobalt-strike_mafia_JC.exe
.exe windows:5 windows x86

7c670e5e894e61afaae5660481218dab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetSystemInfo
VirtualProtect
HeapAlloc
GetProcessHeap
GetProcAddress
LoadLibraryA
lstrlenA
lstrcatA
GetLogicalProcessorInformationEx
FindNextFileW
FindFirstFileW
CloseHandle
Process32Next
Process32First
SetEndOfFile
TerminateProcess
GetCurrentProcess
CreateFileW
CreateFileA
SetStdHandle
WriteConsoleW
LoadLibraryW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetLocaleInfoW
CreateToolhelp32Snapshot
ExitProcess
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
GetLastError
HeapFree
RtlUnwind
RaiseException
HeapReAlloc
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
LCMapStringW
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
GetModuleHandleW
WriteFile
GetStdHandle
GetModuleFileNameW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetACP
GetOEMCP
IsValidCodePage
HeapSize
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointer
FlushFileBuffers
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId

ole32

CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket

oleaut32

VariantInit
SysAllocString
SysFreeString
VariantClear

crypt32

CryptStringToBinaryA

Sections

.text
Size: 281KB - Virtual size: 281KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 221KB - Virtual size: 298KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7c670e5e894e61afaae5660481218dab

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

oleaut32

crypt32

Sections

.text Size: 281KB - Virtual size: 281KB

.rdata Size: 63KB - Virtual size: 63KB

.data Size: 221KB - Virtual size: 298KB

.reloc Size: 22KB - Virtual size: 21KB

.text
Size: 281KB - Virtual size: 281KB

.rdata
Size: 63KB - Virtual size: 63KB

.data
Size: 221KB - Virtual size: 298KB

.reloc
Size: 22KB - Virtual size: 21KB