cobaltstrike | 5f28fbce39995b0602757096dab1a39d99d35ddb8c578d6c1c3a6def47955efc

Sharing

Copy URL Twitter E-mail

General

Target
5f28fbce39995b0602757096dab1a39d99d35ddb8c578d6c1c3a6def47955efc
Size 1.9MB
Sample240324-fl4adsce7t
SHA256 5f28fbce39995b0602757096dab1a39d99d35ddb8c578d6c1c3a6def47955efc
MD5 1710651c8545b9618b6e8a75cea971be
SHA1 48542db01d85c2f117fb24e355def76c2848ae5c
SHA512 fa70583b34ac791037ac5e010052fe7e1bed63609151e6d34edab0a6e8d4f647a32b1a28090f738acc299fda1fc5bd9b38ec7a34dc767781284ebe694ca3610a
SSDEEP 24576:YygFV7y/pN+O3QsgBypVIt3tMLFTX8UqPXZGEUqW68L:SByRN+Hm4cuUqPxpK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

http://178.173.238.115:80/yzyzz

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; Touch; MASPJS)

Signatures

Cobaltstrike family
cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5f28fbce39995b0602757096dab1a39d99d35ddb8c578d6c1c3a6def47955efc

File Explorer

5f28fbce39995b0602757096dab1a39d99d35ddb8c578d6c1c3a6def47955efc

.exe 1.9MB

5f28fbce39995b0602757096dab1a39d99d35ddb8c578d6c1c3a6def47955efc

IMPHASH c2d457ad8ac36fc9f18d45bffcd450c2
SHA256 5f28fbce39995b0602757096dab1a39d99d35ddb8c578d6c1c3a6def47955efc
MD5 1710651c8545b9618b6e8a75cea971be
SHA1 48542db01d85c2f117fb24e355def76c2848ae5c
SHA512 fa70583b34ac791037ac5e010052fe7e1bed63609151e6d34edab0a6e8d4f647a32b1a28090f738acc299fda1fc5bd9b38ec7a34dc767781284ebe694ca3610a
SSDEEP 24576:YygFV7y/pN+O3QsgBypVIt3tMLFTX8UqPXZGEUqW68L:SByRN+Hm4cuUqPxpK
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

408320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

546KB

Virtual Size

545KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

677KB

Virtual Size

677KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

49KB

Virtual Size

595KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

297B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

127KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/32

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/46

Size

512B

Virtual Size

55B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/65

Size

242KB

Virtual Size

241KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/78

Size

117KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/90

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

5f28fbce39995b0602757096dab1a39d99d35ddb8c578d6c1c3a6def47955efc

kernel32

generic