cobaltstrike | 97d294f3d7297c8ea00ed0d5b862885236115cee539d0a4281b7e80d5fbc4de9[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
97d294f3d7297c8ea00ed0d5b862885236115cee539d0a4281b7e80d5fbc4de9.zip
Size 112KB
Sample240802-efet6sygrc
SHA256 8a4d94bf1f61564441701ef429b0e23f0b4dd425d6b1f9fc7b2237da3638f10f
MD5 dc0bd039d7644f1c40aec2363f52bb7d
SHA1 47b31e16e4d15184dff12cd2c4c829f966a45d54
SHA512 61e0387fc00991eaf97901af64e6a1465b80bfe9916db91ea8c9137403a3f50b518d27b83b7c512f0fbac01e55ae93dbae73fefa9c844fca081e6baee95a71fa
SSDEEP 3072:TuHkOPdk0sVG1WMsom+V19VNfZ3FwKcxNWC:TuHfGzM4lH+xfZmK+0C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

100000 cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

http://192.34.56.49:80/IE9CompatViewList.xml

Attributes

access_type
512
host
192.34.56.49,/IE9CompatViewList.xml
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
80
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDhw/moQ0VdyB56chcMLnDtUhv1UVM03XjgzN/oDf0LQsMcu+MMxmZr9HDUiK7XGswd6zX49j/Uu3CBnLBykLhefJFzZlH6ORRDAELHOc9oOsdRwWjxBYcPgGhXp1tNUcJEadPAxRYj7CQKLqdOQ3TZKEYWR7mGQWGrtK5BKlzAzQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
watermark
100000

Signatures

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/97d294f3d7297c8ea00ed0d5b862885236115cee539d0a4281b7e80d5fbc4de9	cobalt_reflective_dll

Cobaltstrike family
cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/97d294f3d7297c8ea00ed0d5b862885236115cee539d0a4281b7e80d5fbc4de9

File Explorer

97d294f3d7297c8ea00ed0d5b862885236115cee539d0a4281b7e80d5fbc4de9.zip

.zip 112KB
97d294f3d7297c8ea00ed0d5b862885236115cee539d0a4281b7e80d5fbc4de9

.dll 208KB

97d294f3d7297c8ea00ed0d5b862885236115cee539d0a4281b7e80d5fbc4de9.zip

SHA256 8a4d94bf1f61564441701ef429b0e23f0b4dd425d6b1f9fc7b2237da3638f10f
MD5 dc0bd039d7644f1c40aec2363f52bb7d
SHA1 47b31e16e4d15184dff12cd2c4c829f966a45d54
SHA512 61e0387fc00991eaf97901af64e6a1465b80bfe9916db91ea8c9137403a3f50b518d27b83b7c512f0fbac01e55ae93dbae73fefa9c844fca081e6baee95a71fa
SSDEEP 3072:TuHkOPdk0sVG1WMsom+V19VNfZ3FwKcxNWC:TuHfGzM4lH+xfZmK+0C
MD5 SHA1 SHA512 SSDEEP

Password

infected

97d294f3d7297c8ea00ed0d5b862885236115cee539d0a4281b7e80d5fbc4de9

IMPHASH cef0a8b67e0adea9dbc532568c79bb24
SHA256 97d294f3d7297c8ea00ed0d5b862885236115cee539d0a4281b7e80d5fbc4de9
MD5 45ba495d35f7e0983558bd4efe9ee091
SHA1 4f4dcac8ceba7c82a9d89fe53dedc658c98cadf7
SHA512 2ff20645d46450ab560d890b4788f6d54cc46b2689e9e8df140b79f11207ddf49bb38f08178db26113b79456758d76a4cc09d59bc8670b548ac546815e9a288d
SSDEEP 3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUkMY5u:LIDff9D8C6XYRw6MT2DEj
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

93381

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

GetThreadContext ReadProcessMemory CreateProcessA TerminateProcess GetCurrentDirectoryW VirtualProtectEx WriteProcessMemory ResumeThread GetFullPathNameA SystemTimeToTzSpecificLocalTime GetLogicalDrives ExpandEnvironmentStringsA GetFileAttributesA FileTimeToSystemTime FindFirstFileA CopyFileA FindClose MoveFileA FindNextFileA OpenProcess GetCurrentProcessId Thread32First Thread32Next VirtualAllocEx OpenThread CreateToolhelp32Snapshot CreateThread CreateRemoteThread SetThreadContext MapViewOfFile UnmapViewOfFile CreateFileMappingA VirtualProtect SetLastError GetVersionExA CreateFileA PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState GetComputerNameA GetACP GetModuleFileNameA GetOEMCP DeleteProcThreadAttributeList HeapAlloc CreateNamedPipeA GetProcessHeap InitializeProcThreadAttributeList SetErrorMode UpdateProcThreadAttribute ProcessIdToSessionId DuplicateHandle Process32First Process32Next VirtualQuery ExitProcess ExitThread ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetCurrentDirectoryA CreatePipe GetLocalTime GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe MultiByteToWideChar WriteFile GetTickCount WaitForSingleObject Sleep GetModuleHandleA DebugBreak RaiseException SetEnvironmentVariableW GetModuleFileNameW LoadLibraryA VirtualAlloc GetProcAddress SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA HeapSize IsValidCodePage GetCPInfo QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetFilePointer VirtualFree HeapFree FreeLibrary GetModuleHandleW DeleteFileA CreateDirectoryA RemoveDirectoryA GetSystemTimeAsFileTime HeapReAlloc GetCurrentThreadId GetCommandLineA HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode SetHandleCount GetFileType

advapi32

LookupAccountSidA OpenThreadToken CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx OpenProcessToken GetTokenInformation GetUserNameA CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA AdjustTokenPrivileges ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA

wininet

InternetSetOptionA InternetConnectA InternetQueryDataAvailable InternetReadFile HttpOpenRequestA HttpAddRequestHeadersA InternetSetStatusCallback HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA HttpQueryInfoA

ws2_32

gethostbyname send WSAIoctl WSAStartup WSACleanup socket WSASocketA ntohl htons htonl connect ntohs recv shutdown WSAGetLastError ioctlsocket accept listen __WSAFDIsSet bind select closesocket