Behavioral task
behavioral1
Sample
2023-08-26_9f9f22ef0195c1903bfc635d7ef96c05_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-26_9f9f22ef0195c1903bfc635d7ef96c05_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Resource
win10v2004-20230915-en
General
-
Target
2023-08-26_9f9f22ef0195c1903bfc635d7ef96c05_cobalt-strike_cobaltstrike_meterpreter_JC.exe
-
Size
201KB
-
MD5
9f9f22ef0195c1903bfc635d7ef96c05
-
SHA1
f9bc0ffbc971fd2eb6c7aefa4d0808d211d8d924
-
SHA256
96f01052c3cc213783e678af1c5ab2c7718366e8bdf41e265e13e0c334414ba2
-
SHA512
575145d25774e715ba0a81517110587af890be5ee41116d8554d567055fba9f95f55e8212eec75bdea9e1336133d327a15d9042ced1b8ae6aa80afb15e7d9faf
-
SSDEEP
3072:0FxsTnEfzEmyfyzwUTgnbiYJZ+bAbudMrxPtj1Um5:REffy6qbiYJZZjrxFj
Malware Config
Extracted
cobaltstrike
0
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule sample cobalt_reflective_dll -
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-08-26_9f9f22ef0195c1903bfc635d7ef96c05_cobalt-strike_cobaltstrike_meterpreter_JC.exe
Files
-
2023-08-26_9f9f22ef0195c1903bfc635d7ef96c05_cobalt-strike_cobaltstrike_meterpreter_JC.exe.dll windows:5 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ