cobaltstrike | 230cb13b9a6d03d492061d98b142779ddf52f5129ef7ff755fa32d1ce94d5a2d

Sharing

Copy URL Twitter E-mail

General

Target

230cb13b9a6d03d492061d98b142779ddf52f5129ef7ff755fa32d1ce94d5a2d
Size

14KB
MD5

96af53e86df8e46b483c40d08d899912
SHA1

79c8c20eff407686539081a1364691d87f6875bd
SHA256

230cb13b9a6d03d492061d98b142779ddf52f5129ef7ff755fa32d1ce94d5a2d
SHA512

9ef7e76c2f95e6befe4af84d226af36633b9c11e29d17ad381ac9e1136174ba0fdc29fa10f6785da5d4dce90f4afd27ba90dc8bc759901eb15eadffbbfd675bc
SSDEEP

192:J6gBwpo43W+tUptS1mGoTLxnfDBaKtcKYqm8S35/xf002CM9K/3:J6/f6ptsmGeDQKnXq5ZMVCbP

Score

10^/10

cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

http://10.134.155.155:443/rd7P

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUS)

Signatures

Cobaltstrike family
cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
230cb13b9a6d03d492061d98b142779ddf52f5129ef7ff755fa32d1ce94d5a2d

Files

230cb13b9a6d03d492061d98b142779ddf52f5129ef7ff755fa32d1ce94d5a2d
.exe windows:4 windows x86

827f25806d6b1a858d85fd1eae1f7b36

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

__getmainargs
__initenv
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_initterm
_iob
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
signal
strlen
strncmp
vfprintf

libgcc_s_dw2-1

__deregister_frame_info
__register_frame_info

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 184B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

827f25806d6b1a858d85fd1eae1f7b36

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

libgcc_s_dw2-1

Sections

.text Size: 5KB - Virtual size: 5KB

.data Size: 1024B - Virtual size: 1024B

.rdata Size: 1KB - Virtual size: 1KB

.eh_fram Size: 2KB - Virtual size: 1KB

.bss Size: - Virtual size: 184B

.idata Size: 1KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 48B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 1024B - Virtual size: 576B

.text
Size: 5KB - Virtual size: 5KB

.data
Size: 1024B - Virtual size: 1024B

.rdata
Size: 1KB - Virtual size: 1KB

.eh_fram
Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 184B

.idata
Size: 1KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 48B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 1024B - Virtual size: 576B