cobaltstrike | 2f0f40fadba9f94a17693d6d8422f832a263eec542c0e9e6460fcb2e5acde8ce[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
2f0f40fadba9f94a17693d6d8422f832a263eec542c0e9e6460fcb2e5acde8ce.zip
Size 114KB
Sample240831-pfpdqasfpc
SHA256 802396c340a7505b5c431614a3b8ae6dc3d214b46d6cdc89e877838344a48e94
MD5 b15cdb314cc2ec348254ebd7ff75b262
SHA1 6854816dfcff6b7a3ed04205e6abcdbdd74991e0
SHA512 13e82d42e5883695df61376f90facc8ce121867ea29efdd27bfe54d9c92e130e1c971802884d773aca09f34ca5b37c14b18ddc0cf0e55535f7bdb98af31adeac
SSDEEP 3072:iVp+Mc4O77S7xahbK2Y0+8ykN9T4rTCR6:i+Tjg2YJCGTCA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

391144938 cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

391144938

http://192.168.220.222:80/match

Attributes

access_type
512
host
192.168.220.222,/match
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
80
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCgGtKfr4nBE6Tp4wtjpXWYcD+DqkHNMc1tPB3dsMLi5TpJckjEJrsZYgiaO+4tb16C3RqrApgC1pIN6pvRfsACtP4jcTeprYaG92OR41J8K5+BkRHW0alCc1U9iANT8otDOtP5ly85PjYKEGevAWyGrh6u7+4L1jp3jFgQSzCrvwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; BOIE8;ENUS)
watermark
391144938

Signatures

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/2f0f40fadba9f94a17693d6d8422f832a263eec542c0e9e6460fcb2e5acde8ce	cobalt_reflective_dll

Cobaltstrike family
cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2f0f40fadba9f94a17693d6d8422f832a263eec542c0e9e6460fcb2e5acde8ce

File Explorer

2f0f40fadba9f94a17693d6d8422f832a263eec542c0e9e6460fcb2e5acde8ce.zip

.zip 114KB
2f0f40fadba9f94a17693d6d8422f832a263eec542c0e9e6460fcb2e5acde8ce

.dll 220KB

2f0f40fadba9f94a17693d6d8422f832a263eec542c0e9e6460fcb2e5acde8ce.zip

SHA256 802396c340a7505b5c431614a3b8ae6dc3d214b46d6cdc89e877838344a48e94
MD5 b15cdb314cc2ec348254ebd7ff75b262
SHA1 6854816dfcff6b7a3ed04205e6abcdbdd74991e0
SHA512 13e82d42e5883695df61376f90facc8ce121867ea29efdd27bfe54d9c92e130e1c971802884d773aca09f34ca5b37c14b18ddc0cf0e55535f7bdb98af31adeac
SSDEEP 3072:iVp+Mc4O77S7xahbK2Y0+8ykN9T4rTCR6:i+Tjg2YJCGTCA
MD5 SHA1 SHA512 SSDEEP

Password

infected

2f0f40fadba9f94a17693d6d8422f832a263eec542c0e9e6460fcb2e5acde8ce

IMPHASH dd2ee89b38b455d38772c37d994f2beb
SHA256 2f0f40fadba9f94a17693d6d8422f832a263eec542c0e9e6460fcb2e5acde8ce
MD5 9a0b92a7c049ed56c58909b14809b60e
SHA1 4b8d06129dd6f268b7987ea2b7f41f3a8dd7bb85
SHA512 9392ad004e917c8774a6464a10c60862d481872a69869e86538449fb4a3b7c16332a81a23e6cbe220a68fd7571d27a838ccd185ee201316d8ec59668046fa74e
SSDEEP 3072:MfyTFpXSc43UtiD8Umh8I6lk0bF+EjJeNDU2a7i78nifiRjdU+5W3BS:MfsD4ktiD8UI8I66C+6AsXnifujg
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

95253

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

GetLocalTime CreatePipe GetCurrentDirectoryA GetCurrentProcess ConnectNamedPipe GetCurrentThread ReadFile CreateNamedPipeA GetThreadContext ReadProcessMemory CreateProcessA TerminateProcess GetCurrentDirectoryW VirtualProtectEx WriteProcessMemory ResumeThread GetFullPathNameA SystemTimeToTzSpecificLocalTime GetLogicalDrives ExpandEnvironmentStringsA GetFileAttributesA FileTimeToSystemTime FindFirstFileA CopyFileA FindClose MoveFileA FindNextFileA OpenProcess GetCurrentProcessId Thread32First Thread32Next VirtualAllocEx OpenThread CreateToolhelp32Snapshot CreateThread CreateRemoteThread SetThreadContext SetLastError GetVersionExA CreateFileA PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState GetComputerNameA GetACP GetModuleFileNameA GetOEMCP DeleteProcThreadAttributeList GetStartupInfoA InitializeProcThreadAttributeList SetErrorMode UpdateProcThreadAttribute ProcessIdToSessionId DuplicateHandle Process32First Process32Next VirtualQuery ExitProcess ExitThread SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe MultiByteToWideChar WriteFile GetTickCount WaitForSingleObject Sleep CloseHandle VirtualProtect GetModuleHandleA CreateFileMappingA LoadLibraryA VirtualAlloc GetProcAddress GetLastError HeapCreate HeapDestroy VirtualFree DebugBreak RaiseException GetModuleFileNameW SetEnvironmentVariableW HeapFree HeapAlloc FreeLibrary SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA HeapSize IsValidCodePage GetCPInfo QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetFilePointer GetFileType SetHandleCount GetConsoleMode UnmapViewOfFile GetProcessHeap MapViewOfFile GetModuleHandleW DeleteFileA CreateDirectoryA RemoveDirectoryA GetSystemTimeAsFileTime HeapReAlloc GetCurrentThreadId GetCommandLineA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP

advapi32

LookupAccountSidA OpenThreadToken CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx OpenProcessToken GetTokenInformation GetUserNameA CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA AdjustTokenPrivileges ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA

wininet

InternetReadFile InternetConnectA InternetQueryDataAvailable InternetSetOptionA HttpOpenRequestA HttpAddRequestHeadersA InternetSetStatusCallback HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA HttpQueryInfoA

ws2_32

ntohs connect socket gethostbyname send WSAIoctl recv WSACleanup closesocket WSASocketA ntohl htons htonl shutdown WSAGetLastError ioctlsocket accept listen __WSAFDIsSet bind sendto select inet_addr recvfrom WSAStartup