2024-05-09_2d42714206546f898fded0001e7077dc_cobalt-strike_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-09_2d42714206546f898fded0001e7077dc_cobalt-strike_magniber
Size

469KB
MD5

2d42714206546f898fded0001e7077dc
SHA1

48cebb525f8018d47aca556861851d5bd5e9574c
SHA256

3fa538d0b901429d169a8d60a2763f2dcdc9ba1e2700b2edc4e0371197329546
SHA512

35835f6f609f26222c896424ed70e20f41fb3b5f627714b154c05b5d6b88c713fd3328cd785978bccfa82d67fde189a9fa221e898826253d0dbe7d8ecaf576d8
SSDEEP

12288:Q2vArPEOMQRLcmJwLH10/BEUud0ajTj3:6rPEOMoK1J/3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-09_2d42714206546f898fded0001e7077dc_cobalt-strike_magniber

Files

2024-05-09_2d42714206546f898fded0001e7077dc_cobalt-strike_magniber
.exe windows:4 windows x86 arch:x86

9f8119a3c1f4db4ad393736bce5a25a8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapDestroy
ExitProcess
GetModuleHandleW
HeapCreate
InitializeSListHead
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentProcess
TerminateProcess
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcAddress
FreeLibrary
GetModuleHandleExW
EnterCriticalSection
DeleteCriticalSection
LeaveCriticalSection
HeapFree
GetLastError
SetLastError
GetCurrentThread
HeapAlloc
EnumSystemLocalesW
LoadLibraryExW
CompareStringW
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
GetDateFormatW
GetLocaleInfoW
GetTempPathW
GetTimeFormatW
GetUserDefaultLCID
InitializeCriticalSectionAndSpinCount
IsValidLocale
LCMapStringW
OutputDebugStringW
GetFileType
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
IsValidCodePage
GetCommandLineA
GetCommandLineW
FindFirstFileExW
FindNextFileW
FindClose
MultiByteToWideChar
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
SetEnvironmentVariableW
SetConsoleCtrlHandler
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapSize
HeapReAlloc
ReadFile
ReadConsoleW
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
EncodePointer
RaiseException
InitializeCriticalSection
WaitForSingleObject
CreateThread
Sleep
LoadLibraryW
DuplicateHandle
CreatePipe
CreateProcessW
PeekNamedPipe
GetExitCodeProcess
GetVersionExW
MulDiv
DeleteFileW
FindFirstFileW
GetDriveTypeW
GetFileAttributesW
CreateDirectoryW
SetFileAttributesW
RemoveDirectoryW
SetFilePointer
UnregisterWait
RegisterWaitForSingleObject
DecodePointer
GetFileSizeEx

user32

SendMessageW
ShowWindow
InvalidateRect
CreateWindowExW
IsWindowVisible
MoveWindow
GetPropW
SetWindowLongW
SetPropW
GetClientRect
IsZoomed
IsIconic
DestroyWindow
GetParent
RemovePropW
CallWindowProcW
FillRect
GetIconInfo
DrawStateW
GetWindowLongW
MessageBoxW
PostMessageW
GetForegroundWindow
GetWindowThreadProcessId
IsWindowEnabled
EnableWindow
EnumWindows
SetWindowPos
SetWindowTextW
GetWindowTextLengthW
GetWindowTextW
SystemParametersInfoW
DefWindowProcW
GetSysColor
GetSysColorBrush
GetDC
SetRect
DrawTextW
GetSystemMetrics
ReleaseDC
GetAsyncKeyState
GetWindow
GetWindowRect
RedrawWindow
SetScrollPos
InflateRect
GetWindowDC
MapWindowPoints
SetActiveWindow
DestroyIcon
LoadIconW
LoadCursorW
RegisterClassW
AdjustWindowRectEx
UnregisterClassW
CreateAcceleratorTableW
GetMenu
PeekMessageW
MsgWaitForMultipleObjects
GetMessageW
GetActiveWindow
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DefFrameProcW
SetFocus
GetFocus
EnumChildWindows
DestroyAcceleratorTable
GetCursorPos
SetForegroundWindow
TrackPopupMenu
ScreenToClient
GetKeyState
GetClassNameW
IsChild
GetMenuItemInfoW
SetMenu
DestroyMenu
CreateMenu
AppendMenuW
SetMenuItemInfoW
RegisterWindowMessageW

ole32

CoInitialize
CoTaskMemFree
RevokeDragDrop
OleUninitialize
OleInitialize

shell32

ShellExecuteW
ShellExecuteExW
Shell_NotifyIconW
SHGetFolderLocation
SHGetPathFromIDListW

gdiplus

GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipDeleteMatrix
GdipDeletePen
GdipDeleteStringFormat
GdipFree

gdi32

GetObjectType
GetObjectW
DeleteObject
IntersectClipRect
GetStockObject
CreateFontIndirectW
SetTextColor
SetBkColor
SelectObject
GetTextExtentPoint32W
ExcludeClipRect
CreateSolidBrush
GetDeviceCaps
CreateBitmap
CreateCompatibleDC
SetPixel
DeleteDC
CreateDIBSection
GetDIBits
BitBlt
CreateDCW
CreateFontW

comdlg32

GetSaveFileNameW
GetOpenFileNameW

comctl32

CreateStatusWindowW
InitCommonControlsEx

Sections

.text
Size: 335KB - Virtual size: 334KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9f8119a3c1f4db4ad393736bce5a25a8

Headers

File Characteristics

Imports

kernel32

user32

ole32

shell32

gdiplus

gdi32

comdlg32

comctl32

Sections

.text Size: 335KB - Virtual size: 334KB

.rdata Size: 49KB - Virtual size: 49KB

.eh_fram Size: 2KB - Virtual size: 2KB

.gfids Size: 512B - Virtual size: 448B

.00cfg Size: 512B - Virtual size: 8B

.data Size: 13KB - Virtual size: 20KB

.rsrc Size: 67KB - Virtual size: 67KB

.text
Size: 335KB - Virtual size: 334KB

.rdata
Size: 49KB - Virtual size: 49KB

.eh_fram
Size: 2KB - Virtual size: 2KB

.gfids
Size: 512B - Virtual size: 448B

.00cfg
Size: 512B - Virtual size: 8B

.data
Size: 13KB - Virtual size: 20KB

.rsrc
Size: 67KB - Virtual size: 67KB