2024-09-03_881098f25e168712a302e7e5d1b6549b_cobalt-strike_megazord

Sharing

Copy URL

Twitter E-mail

General

Target

2024-09-03_881098f25e168712a302e7e5d1b6549b_cobalt-strike_megazord
Size

19.2MB
MD5

881098f25e168712a302e7e5d1b6549b
SHA1

162afa0f8ec756cb41aecd3298bc382e01f81a8c
SHA256

019ccf2010ffaab7add9e318cf7dc0ff6943537bfa5b0db87c4283d6f3c9c0fe
SHA512

10e0eb170cd012e7a1ace1f44c6fe99afb511c2776ea21e217b6fe3b2f579f2594dd02fc4f651e054efe2d96ba13ee8db00e54ec67652905a7289c5d777e9ad5
SSDEEP

98304:WQ8OtYWa7iQLm005cPi3B34pCMkb/+nYSN92/s+OAEYwFNpcqTxji/DAyHfzCKB9:MfQ9vEkEYwFYqZ88wCKvUfu

Score

1^/10

Malware Config

Signatures

Files

2024-09-03_881098f25e168712a302e7e5d1b6549b_cobalt-strike_megazord
.exe windows:6 windows x64 arch:x64

7e17cb0fc3700b0bb2c24f5db2db76c6

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16-11-2023 19:09

Not After

14-11-2024 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:b5:e8:04:b4:07:f0:35:09:39:1f:74:23:22:c2:46:c8:5c:6e:c0:40:d2:c2:6b:59:01:39:36:2a:a8:77:4d
Signer

Actual PE Digest

07:b5:e8:04:b4:07:f0:35:09:39:1f:74:23:22:c2:46:c8:5c:6e:c0:40:d2:c2:6b:59:01:39:36:2a:a8:77:4d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlUnwindEx
RtlPcToFileHeader
RtlGetVersion
NtQueryInformationProcess
NtQuerySystemInformation
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtReadFile
NtWriteFile
NtCreateFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCancelIoFileEx

advapi32

CopySid
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegEnumKeyExW
RegOpenKeyExW
SystemFunction036
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
CredWriteW
CredReadW
CredFree
CredDeleteW
IsValidSid
GetLengthSid
RegisterEventSourceW
LookupAccountSidW
OpenProcessToken
GetTokenInformation
RegCloseKey
RegEnumValueW
DeregisterEventSource
CryptEnumProvidersW

user32

GetProcessWindowStation
GetSystemMetrics
GetUserObjectInformationW
MessageBoxW

crypt32

CertVerifyCertificateChainPolicy
CertAddCertificateContextToStore
CertDuplicateCertificateChain
CertFindCertificateInStore
CertGetCertificateContextProperty
CertOpenStore
CertGetCertificateChain
CertCloseStore
CertDuplicateStore
CertFreeCertificateChain
CertEnumCertificatesInStore
CertFreeCertificateContext
CertDuplicateCertificateContext

ws2_32

send
WSASend
ntohs
select
gethostbyname
htonl
recv
inet_addr
inet_ntoa
gethostbyaddr
getservbyport
getsockname
getservbyname
WSASetLastError
WSACleanup
WSAStartup
freeaddrinfo
htons
getaddrinfo
WSASocketW
connect
accept
socket
WSAIoctl
getpeername
getsockopt
setsockopt
ioctlsocket
closesocket
listen
bind
WSAGetLastError
shutdown

iphlpapi

FreeMibTable
GetAdaptersAddresses
GetIfEntry2
GetIfTable2

kernel32

LoadLibraryExW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetCommandLineA
SetEndOfFile
FlushFileBuffers
GetConsoleOutputCP
GetFileSizeEx
SetStdHandle
FlsAlloc
FlsGetValue
FlsSetValue
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
RaiseException
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
SetEnvironmentVariableW
GetStringTypeW
GetTimeZoneInformation
HeapSize
SystemTimeToFileTime
GetSystemTime
LoadLibraryW
ReadConsoleA
FlsFree
CompareStringW
GetTempPathW
HeapFree
QueryPerformanceCounter
GetLastError
CloseHandle
SwitchToThread
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateFileW
SetNamedPipeHandleState
CreateNamedPipeW
HeapReAlloc
AcquireSRWLockShared
ReleaseSRWLockShared
UnlockFileEx
SetFileInformationByHandle
GetCurrentProcessId
SetFilePointerEx
VirtualUnlock
PostQueuedCompletionStatus
PowerClearRequest
VirtualLock
WaitForSingleObject
GetExitCodeProcess
GetSystemInfo
PowerCreateRequest
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetStdHandle
GetConsoleMode
SetConsoleMode
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetTimeZoneInformationForYear
TryAcquireSRWLockExclusive
FindClose
CopyFileExW
GetProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
PowerSetRequest
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
SetConsoleCursorPosition
CreateMutexA
LockFileEx
GetFileInformationByHandleEx
ReadConsoleInputW
GetNumberOfConsoleInputEvents
GetConsoleCursorInfo
SetConsoleCursorInfo
lstrlenW
GetComputerNameExW
QueryPerformanceFrequency
WakeConditionVariable
GetQueuedCompletionStatusEx
SetLastError
GetFinalPathNameByHandleW
ConnectNamedPipe
ReadFile
GetOverlappedResult
WriteFile
CancelIoEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
Sleep
GetModuleHandleA
GetProcAddress
GetCurrentThread
MultiByteToWideChar
WriteConsoleW
GetModuleHandleW
FormatMessageW
GetCurrentDirectoryW
GetCurrentProcess
GetEnvironmentVariableW
GetModuleFileNameW
GetCommandLineW
GetFileInformationByHandle
GetFullPathNameW
FindNextFileW
CreateDirectoryW
FindFirstFileW
WideCharToMultiByte
ReadConsoleW
SetHandleInformation
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateThread
ReadFileEx
SleepEx
WriteFileEx
WaitForMultipleObjects
CreateEventW
CancelIo
ExitProcess
TerminateProcess
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
WaitForSingleObjectEx
LoadLibraryA
ReleaseMutex
DeleteFileW
MoveFileExW
CreateSymbolicLinkW
SetFileAttributesW
GetFileType
GetTickCount64
GlobalMemoryStatusEx
GetLogicalDrives
GetDiskFreeSpaceExW
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
GetProcessTimes
OpenProcess
ReadProcessMemory
LocalFree
VirtualQueryEx
GetSystemTimes
GetProcessIoCounters
LocalAlloc
CreateHardLinkW
SetFileTime
RegisterWaitForSingleObject
UnregisterWaitEx
SetConsoleCtrlHandler
GetNativeSystemInfo
InitializeSRWLock
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
VirtualFree
GetSystemDirectoryA
FreeLibrary
FormatMessageA
GetACP
LCMapStringW

netapi32

NetUserGetInfo
NetUserEnum
NetApiBufferFree
NetUserGetLocalGroups

ole32

CoUninitialize
CoTaskMemFree
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket

oleaut32

SysFreeString
VariantClear
SysAllocString

pdh

PdhCloseQuery
PdhOpenQueryA
PdhCollectQueryData
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetPerformanceInfo
GetModuleFileNameExW
GetProcessMemoryInfo

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer
AcceptSecurityContext
AcquireCredentialsHandleA
FreeCredentialsHandle
DeleteSecurityContext
FreeContextBuffer
InitializeSecurityContextW
LsaEnumerateLogonSessions
DecryptMessage
ApplyControlToken
EncryptMessage
QueryContextAttributesW

shell32

CommandLineToArgvW
SHGetKnownFolderPath

bcrypt

BCryptGenRandom

Sections

.text
Size: 14.4MB - Virtual size: 14.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 598KB - Virtual size: 597KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7e17cb0fc3700b0bb2c24f5db2db76c6

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:afCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

07:b5:e8:04:b4:07:f0:35:09:39:1f:74:23:22:c2:46:c8:5c:6e:c0:40:d2:c2:6b:59:01:39:36:2a:a8:77:4dSigner

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

advapi32

user32

crypt32

ws2_32

iphlpapi

kernel32

netapi32

ole32

oleaut32

pdh

powrprof

psapi

secur32

shell32

bcrypt

Sections

.text Size: 14.4MB - Virtual size: 14.4MB

.rdata Size: 4.1MB - Virtual size: 4.1MB

.data Size: 34KB - Virtual size: 48KB

.pdata Size: 598KB - Virtual size: 597KB

_RDATA Size: 512B - Virtual size: 244B

.reloc Size: 82KB - Virtual size: 81KB

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

07:b5:e8:04:b4:07:f0:35:09:39:1f:74:23:22:c2:46:c8:5c:6e:c0:40:d2:c2:6b:59:01:39:36:2a:a8:77:4d
Signer

.text
Size: 14.4MB - Virtual size: 14.4MB

.rdata
Size: 4.1MB - Virtual size: 4.1MB

.data
Size: 34KB - Virtual size: 48KB

.pdata
Size: 598KB - Virtual size: 597KB

_RDATA
Size: 512B - Virtual size: 244B

.reloc
Size: 82KB - Virtual size: 81KB