cobaltstrike | db60bab09afc31846c084b0199e4d5510e2581d454f47b03af73d08750627e4b[.]zip

General

Target
db60bab09afc31846c084b0199e4d5510e2581d454f47b03af73d08750627e4b.zip
Size 112KB
Sample240730-f7pdcsvbjk
SHA256 fad59f9676a99b1abd3e05e3cd4b20113c71784904527e5cf58daec128978099
MD5 bac798a05e8f53289b101f866d95b940
SHA1 8794b5421454b0156ca84cb8b6f7451328950a4e
SHA512 4009b75fb9d632994bf2797b4fe2fa31ded11c9df7f5607d3ced95f21df4b130050a6d197454795360158ade169d68d2ddb87470a2ab8414d817f8cae96fa881
SSDEEP 3072:9OpTvad5Z5HAupw9x5xOkaTtmH2un3r9Bs/GkhXTygT1:IFv80B9x5x7aTZ0zGGkVT1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

305419896 cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

C2

http://104.131.8.20:8080/g.pixel

Attributes

access_type
512
host
104.131.8.20,/g.pixel
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
60000
port_number
8080
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtCn5iCi+YLOzSHzWWGn0CAC/24ExcoUg5jIv7S+rccrM37+W3/gIZ+1T5oX1w/T0g48YrU+loE6CwdwRc1LfvnnQ0UKhbqNJbtlUAwAvNzQBZTVTQ2iSCmCfLtaZCSOCCFlwCTduzHhF6aaSYk9MAbos7dPjIpXe5atK5+K8EzwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.4; .NET4.0C)
watermark
305419896

Signatures

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/db60bab09afc31846c084b0199e4d5510e2581d454f47b03af73d08750627e4b	cobalt_reflective_dll

Cobaltstrike family
cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/db60bab09afc31846c084b0199e4d5510e2581d454f47b03af73d08750627e4b

File Explorer

db60bab09afc31846c084b0199e4d5510e2581d454f47b03af73d08750627e4b.zip

.zip 112KB
db60bab09afc31846c084b0199e4d5510e2581d454f47b03af73d08750627e4b

.dll 204KB

db60bab09afc31846c084b0199e4d5510e2581d454f47b03af73d08750627e4b.zip

SHA256 fad59f9676a99b1abd3e05e3cd4b20113c71784904527e5cf58daec128978099
MD5 bac798a05e8f53289b101f866d95b940
SHA1 8794b5421454b0156ca84cb8b6f7451328950a4e
SHA512 4009b75fb9d632994bf2797b4fe2fa31ded11c9df7f5607d3ced95f21df4b130050a6d197454795360158ade169d68d2ddb87470a2ab8414d817f8cae96fa881
SSDEEP 3072:9OpTvad5Z5HAupw9x5xOkaTtmH2un3r9Bs/GkhXTygT1:IFv80B9x5x7aTZ0zGGkVT1
MD5 SHA1 SHA512 SSDEEP

Password

infected

db60bab09afc31846c084b0199e4d5510e2581d454f47b03af73d08750627e4b

IMPHASH b450a8226d3ed9f582c2242845b7b787
SHA256 db60bab09afc31846c084b0199e4d5510e2581d454f47b03af73d08750627e4b
MD5 782e761b494ccbb1ec3f733f185b2fe3
SHA1 2cb7cd144d81c7312943c953f25273359cadea1a
SHA512 22a9b25b903bff7794646fe7574c1777fe9699738e7cffff590c260192126f274e5a56941ac69d02ddd4d85e7b19ba817ac5a0864b17690f7bc358879580da1f
SSDEEP 3072:5dFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzUhjQUB5gK:FRYkcrY4MCIt07iPlvU0jJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

5

Entry point

89512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

ExpandEnvironmentStringsA GetFileAttributesA FileTimeToSystemTime FindFirstFileA CopyFileA FindClose MoveFileA FindNextFileA VirtualProtect CreateRemoteThread OpenProcess VirtualAllocEx LoadLibraryA GetCurrentProcessId Thread32First Thread32Next OpenThread CreateToolhelp32Snapshot CreateThread SetThreadContext MapViewOfFile UnmapViewOfFile VirtualAlloc CreateFileMappingA VirtualFree SetLastError GetVersionExA PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState GetComputerNameA GetACP GetModuleFileNameA GetOEMCP DeleteProcThreadAttributeList HeapAlloc HeapFree GetProcessHeap InitializeProcThreadAttributeList SetErrorMode GetLogicalDrives ProcessIdToSessionId DuplicateHandle Process32First Process32Next VirtualQuery ExitProcess ExitThread SystemTimeToTzSpecificLocalTime GetFullPathNameA ResumeThread WriteProcessMemory VirtualProtectEx GetCurrentDirectoryW TerminateProcess CreateProcessA ReadProcessMemory GetThreadContext GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetLocalTime GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe MultiByteToWideChar WriteFile DebugBreak RaiseException SetEnvironmentVariableW SetFileTime GetTickCount WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA HeapSize IsValidCodePage GetCPInfo GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW CreateFileA Sleep UpdateProcThreadAttribute GetModuleHandleW DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement FreeLibrary InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode SetHandleCount GetFileType SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings GetModuleFileNameW

advapi32

FreeSid DeleteService CreateServiceA CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership RevertToSelf AllocateAndInitializeSid LookupAccountSidA GetTokenInformation RegCloseKey RegEnumKeyA RegEnumValueA RegOpenCurrentUser RegOpenKeyExA GetUserNameA DuplicateTokenEx CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA AdjustTokenPrivileges ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenProcessToken OpenSCManagerA QueryServiceStatus StartServiceA CloseServiceHandle

wininet

InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA HttpQueryInfoA

ws2_32

socket closesocket send gethostname inet_ntoa connect WSACleanup gethostbyname ntohl htons htonl ntohs recv shutdown WSAGetLastError ioctlsocket accept listen __WSAFDIsSet bind select WSAStartup

Sharing