cobaltstrike | d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea

Sharing

Copy URL Twitter E-mail

General

Target
d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea
Size 423KB
Sample240329-sf9ansba8s
SHA256 d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea
MD5 0cbe5e9eb925650ae2637fc171770689
SHA1 a46309d54abddefc3e96ab8316c0dd3f853fa7a0
SHA512 82f8b082842e0ac0e80ede8eec9eb76fbf865c33cfb4cd36ec26b4431835df5ac87378dba8192163a19a0844d9eb2f0341b56c573035ce97e7867ded168d6d19
SSDEEP 3072:146YJeQJxhAgvDtXlW6CoU7on12W4WQmg32hE0nuKo0Lrgu6cO4MQq3jq4FCgDjP:14HoWJDBlSCmj3jqUtbUilcAOPFs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

http://��/uGHX:808333358I��Ey�KI�纆M��

Attributes

user_agent
I��Ey�KI�纆M��

Signatures

Cobaltstrike family
cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea

File Explorer

d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea

.exe 423KB

d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea

IMPHASH 922998ed61639d9561e3b857923192e5
SHA256 d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea
MD5 0cbe5e9eb925650ae2637fc171770689
SHA1 a46309d54abddefc3e96ab8316c0dd3f853fa7a0
SHA512 82f8b082842e0ac0e80ede8eec9eb76fbf865c33cfb4cd36ec26b4431835df5ac87378dba8192163a19a0844d9eb2f0341b56c573035ce97e7867ded168d6d19
SSDEEP 3072:146YJeQJxhAgvDtXlW6CoU7on12W4WQmg32hE0nuKo0Lrgu6cO4MQq3jq4FCgDjP:14HoWJDBlSCmj3jqUtbUilcAOPFs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle CreateFileW ExitProcess FindClose FindFirstFileW FormatMessageW GetCPInfoExW GetCommandLineA GetCommandLineW GetDateFormatW GetFileSize GetLocalTime GetModuleHandleA GetStartupInfoA GetTimeFormatW HeapAlloc HeapFree LocalFree MulDiv MultiByteToWideChar ReadFile SetEndOfFile WideCharToMultiByte WriteFile lstrcmpW

advapi32

IsTextUnicode RegCloseKey RegCreateKeyExW RegOpenKeyW RegQueryValueExW RegSetValueExW

comdlg32

ChooseFontW FindTextW GetFileTitleW GetOpenFileNameW GetSaveFileNameW PrintDlgW ReplaceTextW

gdi32

CreateFontIndirectW DeleteDC DeleteObject EndDoc EndPage ExtTextOutW GetDeviceCaps GetTextExtentExPointW GetTextExtentPoint32W GetTextMetricsW SelectObject SetMapMode StartDocW StartPage

shell32

DragAcceptFiles DragFinish DragQueryFileW ShellAboutW

shlwapi

PathFindFileNameW StrCmpNIW StrCmpNW StrRStrIW StrStrIW StrStrW wnsprintfW

ucrtbase

__p___argc __p___argv _assert _configure_narrow_argv _get_initial_narrow_environment _initialize_narrow_environment _set_app_type exit memcpy wcschr

user32

CheckMenuItem CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW EnableMenuItem EndDialog GetClientRect GetDlgItem GetDlgItemInt GetDlgItemTextW GetMenu GetMessageW GetMonitorInfoW GetParent GetSystemMetrics GetWindowPlacement GetWindowTextLengthW GetWindowTextW InvalidateRect IsClipboardFormatAvailable IsDialogMessageW LoadAcceleratorsW LoadCursorW LoadIconW LoadImageW LoadStringW MessageBoxW MonitorFromRect PostMessageW PostQuitMessage RegisterClassExW RegisterWindowMessageW SendMessageW SetActiveWindow SetDlgItemInt SetDlgItemTextW SetFocus SetWindowPos SetWindowTextW ShowWindow TranslateAcceleratorW TranslateMessage UpdateWindow WinHelpW wsprintfW

Name

.text

Size

24KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

504B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

516B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

184KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

72KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

16KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

28KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea

kernel32

advapi32

comdlg32

gdi32

shell32

shlwapi

ucrtbase

user32

generic