cobaltstrike | 3865c47cee6d02ebcce2ef1b97e18f715238a8387009c540607a6336d2baf609[.]zip

General

Target
3865c47cee6d02ebcce2ef1b97e18f715238a8387009c540607a6336d2baf609.zip
Size 110KB
Sample240918-qasdvstarn
SHA256 96d099eb5326f29c7e96440223816d6ef4b9ea67f47fcfa8817f4cfdccebef3b
MD5 a8caa12b10a2057a5d2274819bda943b
SHA1 5fc011eab1ed061deda9c4810e9cb9776a3c8a56
SHA512 5f62f79f7b2655e0ee684470a285654b094a9d1d9b57c8ea5ebb032fa62edfb8fcc283d91834f2f8763f97cb6256ff6f551cfa2cca248ec3b1bdf2a2bd117f1c
SSDEEP 3072:T07s//xCFjFgqHaYL+ywlzVgAUalChchLwS:v5qsVFVgvacGhMS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike

Malware Config

Signatures

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/3865c47cee6d02ebcce2ef1b97e18f715238a8387009c540607a6336d2baf609	cobalt_reflective_dll

Cobaltstrike family
cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3865c47cee6d02ebcce2ef1b97e18f715238a8387009c540607a6336d2baf609

File Explorer

3865c47cee6d02ebcce2ef1b97e18f715238a8387009c540607a6336d2baf609.zip

.zip 110KB
3865c47cee6d02ebcce2ef1b97e18f715238a8387009c540607a6336d2baf609

.dll 244KB

3865c47cee6d02ebcce2ef1b97e18f715238a8387009c540607a6336d2baf609.zip

SHA256 96d099eb5326f29c7e96440223816d6ef4b9ea67f47fcfa8817f4cfdccebef3b
MD5 a8caa12b10a2057a5d2274819bda943b
SHA1 5fc011eab1ed061deda9c4810e9cb9776a3c8a56
SHA512 5f62f79f7b2655e0ee684470a285654b094a9d1d9b57c8ea5ebb032fa62edfb8fcc283d91834f2f8763f97cb6256ff6f551cfa2cca248ec3b1bdf2a2bd117f1c
SSDEEP 3072:T07s//xCFjFgqHaYL+ywlzVgAUalChchLwS:v5qsVFVgvacGhMS
MD5 SHA1 SHA512 SSDEEP

Password

infected

3865c47cee6d02ebcce2ef1b97e18f715238a8387009c540607a6336d2baf609

IMPHASH 072f0fb2d931f41f8eca43e3ca219fad
SHA256 3865c47cee6d02ebcce2ef1b97e18f715238a8387009c540607a6336d2baf609
MD5 c6adba1cc7f380e8340089e36dc356fb
SHA1 d9510de3f5b7fb26058ac291765a294ed52748ce
SHA512 82ec07e6f862d27a2ea52ed756cc5353ba21130405c91601b26b27f335d5890b8315134fa7fdf50aa28f498a260479b21f40bdb340ec6deb98dabd58a057f929
SSDEEP 3072:GdiFtjEf4gkF6YIc9k8zD9+YMU/cJUO2pmXoD3XFjtU/I5zzz:BJEf1kIYVj1+7U/lbD3Vji
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

88200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

GetThreadContext ReadProcessMemory CreateProcessA TerminateProcess GetCurrentDirectoryW VirtualProtectEx WriteProcessMemory ResumeThread GetFullPathNameA SystemTimeToTzSpecificLocalTime GetLogicalDrives ExpandEnvironmentStringsA GetFileAttributesA FileTimeToSystemTime FindFirstFileA CopyFileA FindClose MoveFileA FindNextFileA VirtualProtect OpenProcess GetCurrentProcessId Thread32First Thread32Next VirtualAllocEx OpenThread CreateToolhelp32Snapshot CreateThread CreateRemoteThread SetThreadContext MapViewOfFile UnmapViewOfFile CreateFileMappingA SetLastError GetVersionExA CreateFileA PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState GetComputerNameA GetACP GetModuleFileNameA GetOEMCP DeleteProcThreadAttributeList CreateNamedPipeA HeapFree GetProcessHeap InitializeProcThreadAttributeList SetErrorMode UpdateProcThreadAttribute ProcessIdToSessionId DuplicateHandle Process32First Process32Next VirtualQuery ExitProcess ExitThread ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetCurrentDirectoryA CreatePipe GetLocalTime GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe MultiByteToWideChar WriteFile GetTickCount WaitForSingleObject Sleep GetModuleHandleA DebugBreak GetModuleFileNameW RaiseException SetEnvironmentVariableW LoadLibraryA VirtualAlloc GetProcAddress SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA HeapSize IsValidCodePage GetCPInfo GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW VirtualFree HeapAlloc FreeLibrary GetModuleHandleW DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode SetHandleCount GetFileType SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW

advapi32

LookupAccountSidA OpenThreadToken CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx OpenProcessToken GetTokenInformation GetUserNameA CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA AdjustTokenPrivileges ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA

wininet

InternetQueryDataAvailable InternetConnectA InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA HttpQueryInfoA

ws2_32

ntohs connect socket closesocket send inet_ntoa WSAStartup WSACleanup gethostbyname ntohl htons htonl recv shutdown WSAGetLastError ioctlsocket accept listen __WSAFDIsSet bind select gethostname

Sharing