com.quansheng.freight_driver_flutter.MainActivity
android.intent.action.MAIN
Overview
overview
10Static
static
10sample.zip
windows7-x64
1sample.zip
windows10-2004-x64
1temp/1.c
windows7-x64
3temp/1.c
windows10-2004-x64
3temp/1.exe
windows7-x64
10temp/1.exe
windows10-2004-x64
10temp/123
ubuntu-24.04-amd64
1temp/CS4.9/CS.lnk
windows7-x64
3temp/CS4.9/CS.lnk
windows10-2004-x64
3temp/CS4.9...ke.bat
windows7-x64
1temp/CS4.9...ke.bat
windows10-2004-x64
1temp/CS4.9...at.lnk
windows7-x64
6temp/CS4.9...at.lnk
windows10-2004-x64
7temp/CS4.9...ke.vbs
windows7-x64
1temp/CS4.9...ke.vbs
windows10-2004-x64
7temp/CS4.9...bs.lnk
windows7-x64
3temp/CS4.9...bs.lnk
windows10-2004-x64
7temp/CS4.9...rImage
ubuntu-22.04-amd64
4temp/CS4.9/c2lint
ubuntu-18.04-amd64
1temp/CS4.9/c2lint
debian-9-armhf
1temp/CS4.9/c2lint
debian-9-mips
temp/CS4.9/c2lint
debian-9-mipsel
1temp/CS4.9...nt.jar
windows7-x64
1temp/CS4.9...nt.jar
windows10-2004-x64
1temp/CS4.9/uHook.jar
windows7-x64
1temp/CS4.9/uHook.jar
windows10-2004-x64
1temp/CS4.9...78.zip
windows7-x64
1temp/CS4.9...78.zip
windows10-2004-x64
1WiFi驱动...��.exe
windows7-x64
1WiFi驱动...��.exe
windows10-2004-x64
10temp/CS4.9...Fi.exe
windows7-x64
1temp/CS4.9...Fi.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
sample.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
sample.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
temp/1.c
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
temp/1.c
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
temp/1.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
temp/1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
temp/123
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral8
Sample
temp/CS4.9/CS.lnk
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
temp/CS4.9/CS.lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
temp/CS4.9/Cobalt_Strike.bat
Resource
win7-20240708-en
Behavioral task
behavioral11
Sample
temp/CS4.9/Cobalt_Strike.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
temp/CS4.9/Cobalt_Strike.bat.lnk
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
temp/CS4.9/Cobalt_Strike.bat.lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
temp/CS4.9/Cobalt_Strike.vbs
Resource
win7-20240708-en
Behavioral task
behavioral15
Sample
temp/CS4.9/Cobalt_Strike.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
temp/CS4.9/Cobalt_Strike.vbs.lnk
Resource
win7-20240903-en
Behavioral task
behavioral17
Sample
temp/CS4.9/Cobalt_Strike.vbs.lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral18
Sample
temp/CS4.9/TeamServerImage
Resource
ubuntu2204-amd64-20240729-en
Behavioral task
behavioral19
Sample
temp/CS4.9/c2lint
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral20
Sample
temp/CS4.9/c2lint
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral21
Sample
temp/CS4.9/c2lint
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral22
Sample
temp/CS4.9/c2lint
Resource
debian9-mipsel-20240729-en
Behavioral task
behavioral23
Sample
temp/CS4.9/cobaltstrike-client.jar
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
temp/CS4.9/cobaltstrike-client.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
temp/CS4.9/uHook.jar
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
temp/CS4.9/uHook.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
temp/CS4.9/uploads/CVE-2024-30078.zip
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
temp/CS4.9/uploads/CVE-2024-30078.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
WiFi驱动高危漏洞补丁.exe
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
WiFi驱动高危漏洞补丁.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
temp/CS4.9/uploads/WiFi.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
temp/CS4.9/uploads/WiFi.exe
Resource
win10v2004-20240802-en
Target
sample.zip
Size
164.6MB
MD5
9184f812e7551c188005d99e431d3684
SHA1
4f2ca58cd4ca6d012df7f7bfeb5769e4418f63eb
SHA256
e903253b73d3e43e98088dce800bd5fb75c9b2786153c6d0150080c1d002bbb3
SHA512
80c7c2878edba585b63f745e9d7924f3fd0ab72fd3d6a42c348affbced42152b76b0f20ab26ffa9e91b529387a721b00d217e67e43bd74b44e0d60b967c45e96
SSDEEP
3145728:7IJo8sA8wiVpfcFSeiMl00hjqN6M/QChLy5zSrbgpljrPIxPLzqJedD+DC3mb:OoTAUpc4eiruo5DUpl3PoeiyDC36
cobaltstrike
http://:4444YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
http://M1�H��H��H��H��A������H��jAXL��H��A���7g��H1�H��A���8���M1�H1�H��A�t�;���H��H��A�unMa��H�Ġ:1220708680M1�H1�H��A�t�;���H��H��A�unMa��H�Ġ
http://M1�H��H��H��H��A������H��jAXL��H��A���ta��H��@:1220708680H��M1�jAXH��A���_��H�� ^��j@AYh
h
metasploit
windows/download_exec
http://:4444YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
metasploit
metasploit_stager
127.0.0.1:4444
Detects the reflective loader used by Cobalt Strike.
resource | yara_rule |
---|---|
static1/unpack001/temp/CS4.9/TeamServerImage | cobalt_reflective_dll |
description | ioc |
---|---|
Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE |
Allows an application to access any geographic locations persisted in the user's shared collection. | android.permission.ACCESS_MEDIA_LOCATION |
Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION |
Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION |
Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE |
Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE |
Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE |
Allows an application to request installing packages. | android.permission.REQUEST_INSTALL_PACKAGES |
Allows an application to read image files from external storage. | android.permission.READ_MEDIA_IMAGES |
Allows an application to read video files from external storage. | android.permission.READ_MEDIA_VIDEO |
Allows an application to read audio files from external storage. | android.permission.READ_MEDIA_AUDIO |
Required to be able to access the camera device. | android.permission.CAMERA |
Allows an application to record audio. | android.permission.RECORD_AUDIO |
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE |
Checks for missing Authenticode signature.
resource |
---|
unpack001/temp/1.exe |
unpack004/WiFi驱动高危漏洞补丁.exe |
unpack001/temp/CS4.9/uploads/WiFi.exe |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
CloseHandle
ConnectNamedPipe
CreateFileA
CreateNamedPipeA
CreateThread
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
ReadFile
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualProtect
VirtualQuery
WriteFile
__C_specific_handler
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
signal
sprintf
strlen
strncmp
vfprintf
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
android.intent.action.MAIN
android.permission.READ_EXTERNAL_STORAGE
android.permission.ACCESS_MEDIA_LOCATION
android.permission.WAKE_LOCK
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_WIFI_STATE
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.INTERNET
android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.READ_MEDIA_IMAGES
android.permission.READ_MEDIA_VIDEO
android.permission.READ_MEDIA_AUDIO
android.permission.CAMERA
android.permission.RECORD_AUDIO
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.READ_PHONE_STATE
com.android.launcher.permission.READ_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.FOREGROUND_SERVICE
com.quansheng.ntoccDriver.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
android.permission.INSTALL_PACKAGES
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW
android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED
androidx.work.impl.background.systemalarm.UpdateProxies
androidx.work.diagnostics.REQUEST_DIAGNOSTICS
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
D:\VS2022\source\起飞1\x64\Release\起飞1.pdb
CloseHandle
CompareStringW
CreateFileMappingW
CreateFileW
CreateProcessA
DeleteCriticalSection
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetEnvironmentStringsW
GetFileSizeEx
GetFileType
GetLastError
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetTimeFormatW
GetUserDefaultLCID
HeapAlloc
HeapFree
HeapQueryInformation
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
MapViewOfFile
MultiByteToWideChar
OutputDebugStringW
QueryPerformanceCounter
QueueUserAPC
RaiseException
ReadConsoleW
ReadFile
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEnvironmentVariableW
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
WideCharToMultiByte
WriteConsoleW
WriteFile
MapViewOfFileNuma2
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
D:\VS2022\source\起飞1\x64\Release\起飞1.pdb
CloseHandle
CompareStringW
CreateFileMappingW
CreateFileW
CreateProcessA
DeleteCriticalSection
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetEnvironmentStringsW
GetFileSizeEx
GetFileType
GetLastError
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetTimeFormatW
GetUserDefaultLCID
HeapAlloc
HeapFree
HeapQueryInformation
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
MapViewOfFile
MultiByteToWideChar
OutputDebugStringW
QueryPerformanceCounter
QueueUserAPC
RaiseException
ReadConsoleW
ReadFile
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEnvironmentVariableW
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
WideCharToMultiByte
WriteConsoleW
WriteFile
MapViewOfFileNuma2
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ