cobaltstrike | e7436257a8459ae2e5658b47bc8ecce94ce915e9091647f3644d35c8c7118cd2[.]zip

General

Target
e7436257a8459ae2e5658b47bc8ecce94ce915e9091647f3644d35c8c7118cd2.zip
Size 112KB
Sample240722-walh7syglc
SHA256 e3d7fcc36cda432999226b29d6e9d3ec49ad55702b81c0a4b0e6a0cc4997a44b
MD5 1a6dd0a46f3476eeceebe914dabe4177
SHA1 5dbcb355e3af8aae779c811cd2962bc1c079801a
SHA512 35725ccf97f4cc0b559d0b4cef9f165a6bb78b1ab3ce0e660275225138f21aa4a4e4fc6ffc1ded696ca09a3ee7d479ae681acfe8f7c58c743c606821e9672210
SSDEEP 1536:1SlRmFjoL3cFnfe2r4eOUnzrQVyNwzgmFPoFBe/1KKOjfYZdXsuJQ1jF9LCoS41z:UiBY3snlke5sFzFPa3rQYQQxCi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

305419896 cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

C2

http://104.236.128.148:8080/activity

Attributes

access_type
512
host
104.236.128.148,/activity
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
60000
port_number
8080
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtCn5iCi+YLOzSHzWWGn0CAC/24ExcoUg5jIv7S+rccrM37+W3/gIZ+1T5oX1w/T0g48YrU+loE6CwdwRc1LfvnnQ0UKhbqNJbtlUAwAvNzQBZTVTQ2iSCmCfLtaZCSOCCFlwCTduzHhF6aaSYk9MAbos7dPjIpXe5atK5+K8EzwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0; MASP)
watermark
305419896

Signatures

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/e7436257a8459ae2e5658b47bc8ecce94ce915e9091647f3644d35c8c7118cd2	cobalt_reflective_dll

Cobaltstrike family
cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e7436257a8459ae2e5658b47bc8ecce94ce915e9091647f3644d35c8c7118cd2

File Explorer

e7436257a8459ae2e5658b47bc8ecce94ce915e9091647f3644d35c8c7118cd2.zip

.zip 112KB
e7436257a8459ae2e5658b47bc8ecce94ce915e9091647f3644d35c8c7118cd2

.dll 204KB

e7436257a8459ae2e5658b47bc8ecce94ce915e9091647f3644d35c8c7118cd2.zip

SHA256 e3d7fcc36cda432999226b29d6e9d3ec49ad55702b81c0a4b0e6a0cc4997a44b
MD5 1a6dd0a46f3476eeceebe914dabe4177
SHA1 5dbcb355e3af8aae779c811cd2962bc1c079801a
SHA512 35725ccf97f4cc0b559d0b4cef9f165a6bb78b1ab3ce0e660275225138f21aa4a4e4fc6ffc1ded696ca09a3ee7d479ae681acfe8f7c58c743c606821e9672210
SSDEEP 1536:1SlRmFjoL3cFnfe2r4eOUnzrQVyNwzgmFPoFBe/1KKOjfYZdXsuJQ1jF9LCoS41z:UiBY3snlke5sFzFPa3rQYQQxCi
MD5 SHA1 SHA512 SSDEEP

Password

infected

e7436257a8459ae2e5658b47bc8ecce94ce915e9091647f3644d35c8c7118cd2

IMPHASH b450a8226d3ed9f582c2242845b7b787
SHA256 e7436257a8459ae2e5658b47bc8ecce94ce915e9091647f3644d35c8c7118cd2
MD5 5de1685cf392d2e08f8ba14d90dbf26b
SHA1 e697307a8a053ded6cde28d7a63e812dd13c26b4
SHA512 032f363f9b5a3ecd43637b486ff6d5bad06ff503d9d611fb180a6beb8e3647af4b05d688517faaa60136307842ae80d0db5e2bf514abee83d847a27b9cf34cd4
SSDEEP 3072:5dFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzUhjQUFC5g:FRYkcrY4MCIt07iPlvU0j
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

5

Entry point

89512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

ExpandEnvironmentStringsA GetFileAttributesA FileTimeToSystemTime FindFirstFileA CopyFileA FindClose MoveFileA FindNextFileA VirtualProtect CreateRemoteThread OpenProcess VirtualAllocEx LoadLibraryA GetCurrentProcessId Thread32First Thread32Next OpenThread CreateToolhelp32Snapshot CreateThread SetThreadContext MapViewOfFile UnmapViewOfFile VirtualAlloc CreateFileMappingA VirtualFree SetLastError GetVersionExA PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState GetComputerNameA GetACP GetModuleFileNameA GetOEMCP DeleteProcThreadAttributeList HeapAlloc HeapFree GetProcessHeap InitializeProcThreadAttributeList SetErrorMode GetLogicalDrives ProcessIdToSessionId DuplicateHandle Process32First Process32Next VirtualQuery ExitProcess ExitThread SystemTimeToTzSpecificLocalTime GetFullPathNameA ResumeThread WriteProcessMemory VirtualProtectEx GetCurrentDirectoryW TerminateProcess CreateProcessA ReadProcessMemory GetThreadContext GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetLocalTime GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe MultiByteToWideChar WriteFile DebugBreak RaiseException SetEnvironmentVariableW SetFileTime GetTickCount WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA HeapSize IsValidCodePage GetCPInfo GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW CreateFileA Sleep UpdateProcThreadAttribute GetModuleHandleW DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement FreeLibrary InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode SetHandleCount GetFileType SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings GetModuleFileNameW

advapi32

FreeSid DeleteService CreateServiceA CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership RevertToSelf AllocateAndInitializeSid LookupAccountSidA GetTokenInformation RegCloseKey RegEnumKeyA RegEnumValueA RegOpenCurrentUser RegOpenKeyExA GetUserNameA DuplicateTokenEx CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA AdjustTokenPrivileges ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenProcessToken OpenSCManagerA QueryServiceStatus StartServiceA CloseServiceHandle

wininet

InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA HttpQueryInfoA

ws2_32

socket closesocket send gethostname inet_ntoa connect WSACleanup gethostbyname ntohl htons htonl ntohs recv shutdown WSAGetLastError ioctlsocket accept listen __WSAFDIsSet bind select WSAStartup

Sharing