2024-08-07_2fe46869ae783dbeae4910d4e5bec948_cobalt-strike_hijackloader_megazord

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-07_2fe46869ae783dbeae4910d4e5bec948_cobalt-strike_hijackloader_megazord
Size

21.7MB
MD5

2fe46869ae783dbeae4910d4e5bec948
SHA1

1281253e21508812cd7471fc3cc9f64a283d8888
SHA256

33ee32047e9e987b218cd1e7d797418813ad1e88b837534dcd902302372a51a6
SHA512

cf114ef0c4679b87f6247a61f4f016d4bf51f31982b397a860745107d5cfe7687929c06439f18a25f20288f715e5bcc5a8170899577c2053adf9ac2e8de563ed
SSDEEP

196608:AvcVjGOW+Nj7DTdpII3TvrgU+q9vg3e/jbs4nJNzeCpcmBwMJLz04x5H:AqjVW+Nf/dD3TzgU+q9vg3e/jbsMZLQM

Score

1^/10

Malware Config

Signatures

Files

2024-08-07_2fe46869ae783dbeae4910d4e5bec948_cobalt-strike_hijackloader_megazord
.exe windows:6 windows x64 arch:x64

98026e63b07c75e35157f4428e142917

Code Sign

01:4f:1b:7d:7b:2c:8c:17:91:02:66:54:38:5a:f2:d2
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

02/03/2021, 00:00

Not After

25/03/2024, 23:59

Subject

CN=Zscaler\, Inc.,O=Zscaler\, Inc.,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8d:8d:f0:0b:6c:52:f3:f8:ed:08:f1:a9:f7:40:57:14:46:f1:6b:16
Signer

Actual PE Digest

8d:8d:f0:0b:6c:52:f3:f8:ed:08:f1:a9:f7:40:57:14:46:f1:6b:16

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\jenkins-runner\workspace\ZD_endpoint_master@2\src\asr\CredentialExposure.Console\bin\Release\net8.0-windows\win-x64\native\CredentialExposure.Console.pdb

Imports

advapi32

RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenCurrentUser
OpenProcessToken
LookupAccountSidW
GetTokenInformation
LookupPrivilegeValueW
AdjustTokenPrivileges
CredEnumerateW
CredFree
ConvertStringSidToSidW
CreateWellKnownSid
GetWindowsAccountDomainSid
IsWellKnownSid
OpenThreadToken
RevertToSelf
ImpersonateLoggedOnUser
CloseServiceHandle
EnumServicesStatusExW
GetServiceDisplayNameW
GetServiceKeyNameW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
EqualDomainSid
GetLengthSid
GetSidIdentifierAuthority
GetSidSubAuthority
CopySid
SetThreadToken
DuplicateTokenEx
GetSecurityDescriptorLength

bcrypt

BCryptGenRandom
BCryptDecrypt
BCryptExportKey
BCryptFinishHash
BCryptGetProperty
BCryptHashData
BCryptImportKey
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptCreateHash
BCryptDestroyKey
BCryptEncrypt

crypt32

CryptProtectData
CryptDecodeObject
CertVerifyTimeValidity
CertSetCertificateContextProperty
CertSerializeCertificateStoreElement
CertFreeCRLContext
CertFreeCertificateChainEngine
CertSaveStore
CertCloseStore
PFXImportCertStore
PFXExportCertStore
CryptFindOIDInfo
CryptQueryObject
CryptMsgGetParam
CryptMsgClose
CryptImportPublicKeyInfoEx2
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CryptFormatObject
CryptUnprotectData
CertAddCertificateContextToStore
CertAddCertificateLinkToStore
CertControlStore
CertCreateCertificateChainEngine
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertGetCertificateChain
CertGetIntendedKeyUsage
CertGetNameStringW
CertGetValidUsages
CertNameToStrW
CertOpenStore

iphlpapi

GetPerAdapterInfo
GetAdaptersAddresses
GetNetworkParams
if_nametoindex

kernel32

IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
RtlUnwindEx
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlPcToFileHeader
SetLastError
GetLastError
ReadDirectoryChangesW
CreateFileW
GetTickCount64
CancelIoEx
FormatMessageW
QueryPerformanceCounter
CloseThreadpoolIo
GetCurrentProcessId
GetEnvironmentStringsW
MultiByteToWideChar
GetStdHandle
RaiseFailFastException
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
GetCalendarInfoEx
CompareStringOrdinal
CompareStringEx
FindNLSStringEx
GetLocaleInfoEx
EnumSystemLocalesEx
ResolveLocaleName
LCIDToLocaleName
GetUserPreferredUILanguages
FindStringOrdinal
GetCurrentProcess
GetCurrentThread
WaitForSingleObject
Sleep
DeleteCriticalSection
LocalFree
EnterCriticalSection
SleepConditionVariableCS
LeaveCriticalSection
WakeConditionVariable
InitializeCriticalSection
InitializeConditionVariable
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForMultipleObjectsEx
GetCurrentThreadId
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
QueryPerformanceFrequency
GetFullPathNameW
GetLongPathNameW
WideCharToMultiByte
GetCPInfo
LocalAlloc
GetConsoleOutputCP
GetProcAddress
LocaleNameToLCID
LCMapStringEx
EnumTimeFormatsEx
EnumCalendarInfoExEx
CancelSynchronousIo
CreateIoCompletionPort
CreateDirectoryW
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
DeleteFileW
DeviceIoControl
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FlushFileBuffers
FreeLibrary
GetCurrentDirectoryW
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileType
GetFinalPathNameByHandleW
GetModuleFileNameW
GetOverlappedResult
GetSystemDirectoryW
LoadLibraryExW
OpenThread
OutputDebugStringW
QueryUnbiasedInterruptTime
ReadFile
SetConsoleCtrlHandler
SetFileInformationByHandle
SetFilePointerEx
SetThreadErrorMode
CreateThread
ResumeThread
DuplicateHandle
GetThreadPriority
SetThreadPriority
GetDynamicTimeZoneInformation
GetTimeZoneInformation
WriteFile
GetCurrentProcessorNumberEx
CloseHandle
SetEvent
ResetEvent
CreateEventExW
GetEnvironmentVariableW
FreeEnvironmentStringsW
CreateMutexExW
ReleaseMutex
CreateSemaphoreExW
ReleaseSemaphore
GetCPInfoExW
GetConsoleScreenBufferInfo
GetConsoleMode
ReadConsoleW
SetConsoleTextAttribute
WriteConsoleW
SetConsoleMode
GetComputerNameExW
GetExitCodeProcess
CreateProcessW
TerminateProcess
OpenProcess
K32EnumProcesses
GetProcessId
CreatePipe
GetConsoleCP
CompareStringW
LoadLibraryW
FlushProcessWriteBuffers
WaitForSingleObjectEx
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleW
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
InitializeCriticalSectionEx
VirtualQuery
GetSystemTimeAsFileTime
DebugBreak
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
RtlLookupFunctionEntry
InitializeSListHead

ncrypt

NCryptGetProperty
NCryptImportKey
NCryptOpenKey
NCryptOpenStorageProvider
NCryptDeleteKey
NCryptFreeObject
NCryptSetProperty

ole32

CoInitializeEx
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoGetApartmentType
CoGetContextToken
CoCreateGuid
CoSetProxyBlanket
CoCreateInstance
CoWaitForMultipleHandles

oleaut32

SysAllocStringLen
VariantInit
VariantClear
SysFreeString

secur32

GetUserNameExW
LsaFreeReturnBuffer
LsaEnumerateLogonSessions
LsaGetLogonSessionData
LsaConnectUntrusted
LsaCallAuthenticationPackage
LsaDeregisterLogonProcess

user32

LoadStringW

version

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

ws2_32

select
send
setsockopt
shutdown
recv
WSAGetOverlappedResult
WSARecv
GetNameInfoW
WSASend
WSASocketW
FreeAddrInfoExW
WSACleanup
ioctlsocket
GetAddrInfoW
FreeAddrInfoW
WSAConnect
GetAddrInfoExW
WSAEventSelect
WSAIoctl
bind
closesocket
getpeername
getsockopt
WSAStartup

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
_callnewh
calloc
free
realloc

api-ms-win-crt-math-l1-1-0

fmodf
nanf
__setusermatherr
fmod
ceil
cos
exp
floor
log
log10
pow
sin
tan
modf
ceilf
cosf
expf
floorf
logf
powf
sinf
modff
log2
atan2
fma
acosh
asinh
atanh
cosh
sinh
tanh
cbrt
acos
asin
atan
log2f
atan2f
fmaf
acoshf
asinhf
atanhf
coshf
sinhf
tanhf
log10f
cbrtf
acosf
asinf
atanf
tanf
nan

api-ms-win-crt-string-l1-1-0

strcpy_s
strncpy_s
_stricmp
strcmp
wcsncmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

__p___wargv
__p___argc
_exit
exit
_initterm_e
terminate
_initterm
abort
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_c_exit
_set_app_type
_crt_atexit
_initialize_onexit_table
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_cexit
_register_onexit_function

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf
__stdio_common_vsprintf_s
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

ConnectServer
CreateWbemLocator
DotNetRuntimeDebugHeader
ExecQuery
Get
GetNames
GetType
Next
ReleaseIUnknown
Reset
SetProxy

Sections

.text
Size: 578KB - Virtual size: 577KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.managed
Size: 11.3MB - Virtual size: 11.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

hydrated
Size: - Virtual size: 5.9MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8.7MB - Virtual size: 8.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 89KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 964KB - Virtual size: 964KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

98026e63b07c75e35157f4428e142917

Code Sign

01:4f:1b:7d:7b:2c:8c:17:91:02:66:54:38:5a:f2:d2Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

8d:8d:f0:0b:6c:52:f3:f8:ed:08:f1:a9:f7:40:57:14:46:f1:6b:16Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

bcrypt

crypt32

iphlpapi

kernel32

ncrypt

ole32

oleaut32

secur32

user32

version

ws2_32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 578KB - Virtual size: 577KB

.managed Size: 11.3MB - Virtual size: 11.3MB

hydrated Size: - Virtual size: 5.9MB

.rdata Size: 8.7MB - Virtual size: 8.7MB

.data Size: 89KB - Virtual size: 416KB

.pdata Size: 964KB - Virtual size: 964KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 13KB - Virtual size: 12KB

01:4f:1b:7d:7b:2c:8c:17:91:02:66:54:38:5a:f2:d2
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

8d:8d:f0:0b:6c:52:f3:f8:ed:08:f1:a9:f7:40:57:14:46:f1:6b:16
Signer

.text
Size: 578KB - Virtual size: 577KB

.managed
Size: 11.3MB - Virtual size: 11.3MB

hydrated
Size: - Virtual size: 5.9MB

.rdata
Size: 8.7MB - Virtual size: 8.7MB

.data
Size: 89KB - Virtual size: 416KB

.pdata
Size: 964KB - Virtual size: 964KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 13KB - Virtual size: 12KB