cobaltstrike | 4e37706df49d9a690a43092ccb257242c9549156224977f1abda7d8403f310c3

General

Target
4e37706df49d9a690a43092ccb257242c9549156224977f1abda7d8403f310c3
Size 111KB
Sample240730-gr4zjsvcjp
SHA256 4e37706df49d9a690a43092ccb257242c9549156224977f1abda7d8403f310c3
MD5 90e4ad61e094cb1d5f1b31cd9cd0ec86
SHA1 d18d711a9ba502ffe92d1abcce0578c92269adea
SHA512 93c48cfbf364191d8d5a88afeafd83b8afeecd83210f78be7601e5c432a124347867e317ff2f50989a7844af2369d1e3a97b8e334f95bab5131a06bcebcad9f2
SSDEEP 3072:T5t5eCPDyIxovxtDPdusxYJRSxcnxVihcEwKL:T5t55xoJ1YsxZcnxV8cfc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike

Malware Config

Signatures

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/cbc6ac283695f369518021b584d896b928c348f135a4450b840f479acb4d3ac0	cobalt_reflective_dll

Cobaltstrike family
cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cbc6ac283695f369518021b584d896b928c348f135a4450b840f479acb4d3ac0

File Explorer

4e37706df49d9a690a43092ccb257242c9549156224977f1abda7d8403f310c3

.zip 111KB
cbc6ac283695f369518021b584d896b928c348f135a4450b840f479acb4d3ac0

.dll 244KB

4e37706df49d9a690a43092ccb257242c9549156224977f1abda7d8403f310c3

SHA256 4e37706df49d9a690a43092ccb257242c9549156224977f1abda7d8403f310c3
MD5 90e4ad61e094cb1d5f1b31cd9cd0ec86
SHA1 d18d711a9ba502ffe92d1abcce0578c92269adea
SHA512 93c48cfbf364191d8d5a88afeafd83b8afeecd83210f78be7601e5c432a124347867e317ff2f50989a7844af2369d1e3a97b8e334f95bab5131a06bcebcad9f2
SSDEEP 3072:T5t5eCPDyIxovxtDPdusxYJRSxcnxVihcEwKL:T5t55xoJ1YsxZcnxV8cfc
MD5 SHA1 SHA512 SSDEEP

Password

infected

cbc6ac283695f369518021b584d896b928c348f135a4450b840f479acb4d3ac0

IMPHASH b450a8226d3ed9f582c2242845b7b787
SHA256 cbc6ac283695f369518021b584d896b928c348f135a4450b840f479acb4d3ac0
MD5 645d4f2ae21bc8009550189407888ccc
SHA1 3130a75dea2af4a7b51064fbc1260d40127f5f2d
SHA512 e3a49143fe538da3218b19f0b92d3916ef41e859ba7e9851cebe393f0ca98a062822b16924a0a5803ebed81cc7587b4d732f32d12d8c069266804e84a1ea14ed
SSDEEP 3072:adFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzOhjQUB5/:kRYkcrY4MCIt07iPlvUqj
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

89512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

ExpandEnvironmentStringsA GetFileAttributesA FileTimeToSystemTime FindFirstFileA CopyFileA FindClose MoveFileA FindNextFileA VirtualProtect CreateRemoteThread OpenProcess VirtualAllocEx LoadLibraryA GetCurrentProcessId Thread32First Thread32Next OpenThread CreateToolhelp32Snapshot CreateThread SetThreadContext MapViewOfFile UnmapViewOfFile VirtualAlloc CreateFileMappingA VirtualFree SetLastError GetVersionExA PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState GetComputerNameA GetACP GetModuleFileNameA GetOEMCP DeleteProcThreadAttributeList HeapAlloc HeapFree GetProcessHeap InitializeProcThreadAttributeList SetErrorMode GetLogicalDrives ProcessIdToSessionId DuplicateHandle Process32First Process32Next VirtualQuery ExitProcess ExitThread SystemTimeToTzSpecificLocalTime GetFullPathNameA ResumeThread WriteProcessMemory VirtualProtectEx GetCurrentDirectoryW TerminateProcess CreateProcessA ReadProcessMemory GetThreadContext GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetLocalTime GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe MultiByteToWideChar WriteFile DebugBreak RaiseException SetEnvironmentVariableW SetFileTime GetTickCount WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA HeapSize IsValidCodePage GetCPInfo GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW CreateFileA Sleep UpdateProcThreadAttribute GetModuleHandleW DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement FreeLibrary InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode SetHandleCount GetFileType SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings GetModuleFileNameW

advapi32

FreeSid DeleteService CreateServiceA CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership RevertToSelf AllocateAndInitializeSid LookupAccountSidA GetTokenInformation RegCloseKey RegEnumKeyA RegEnumValueA RegOpenCurrentUser RegOpenKeyExA GetUserNameA DuplicateTokenEx CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA AdjustTokenPrivileges ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenProcessToken OpenSCManagerA QueryServiceStatus StartServiceA CloseServiceHandle

wininet

InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA HttpQueryInfoA

ws2_32

socket closesocket send gethostname inet_ntoa connect WSACleanup gethostbyname ntohl htons htonl ntohs recv shutdown WSAGetLastError ioctlsocket accept listen __WSAFDIsSet bind select WSAStartup

Sharing