2024-09-18_279f5beee9d4bf8c54026e78acba61b1_cobalt-strike_megacortex

Sharing

Copy URL

Twitter E-mail

General

Target

2024-09-18_279f5beee9d4bf8c54026e78acba61b1_cobalt-strike_megacortex
Size

248KB
MD5

279f5beee9d4bf8c54026e78acba61b1
SHA1

e473e5b82ce65cb58fde4956ae529453eb0ec24f
SHA256

8e1bbe4cedeb7c334fe780ab3fb589fe30ed976153618ac3402a5edff1b17d64
SHA512

544b1c05e7a7f72871c37794d439d5486ea3b9f252687f13b07bae232aa532a34f5104c80ee8382ec251aae884616b034514237629fafcff35340b23b888442c
SSDEEP

6144:pIqxB9hYLylH4GcbfjBaAsaH4+kwLmNC9fAn+CV:iqxgyp4lD0As+FiC94nL

Score

1^/10

Malware Config

Signatures

Files

2024-09-18_279f5beee9d4bf8c54026e78acba61b1_cobalt-strike_megacortex
.exe windows:5 windows x86 arch:x86

491b656231f46ba0e951610cc776813a

Code Sign

aa:f6:5b:8e:7a:2e:68:bc:8c:9e:8f:27:33:1b:79:5c
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

05-02-2019 00:00

Not After

03-02-2020 23:59

Subject

CN=ALISA L LIMITED,O=ALISA L LIMITED,POSTALCODE=RM6 4DE,STREET=8 Quarles Park Road,L=ROMFORD,ST=ROMFORD,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

01-02-2010 00:00

Not After

18-01-2038 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ef:c0:37:29:b8:01:d1:94:8e:61:b4:a0:8d:bf:d6:9d:80:52:90:b8
Signer

Actual PE Digest

ef:c0:37:29:b8:01:d1:94:8e:61:b4:a0:8d:bf:d6:9d:80:52:90:b8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

Sleep
FindClose
HeapDestroy
FormatMessageW
GetVersionExA
GetVersionExW
lstrlenW
ExitProcess
CloseHandle
CreateEventW
GetLastError
LoadLibraryA
GetProcAddress
VirtualAlloc
GetCommandLineA
GetModuleHandleA
TerminateProcess
InterlockedDecrement
GetStartupInfoA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetCurrentThread
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
OutputDebugStringA
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryExA
InitializeCriticalSection
HeapAlloc
HeapReAlloc
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
VirtualProtect
GetSystemInfo
VirtualQuery
GetLocaleInfoW
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA

advapi32

RegEnumValueA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegDeleteKeyW

comctl32

ImageList_Add

Sections

.text
Size: 228KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

491b656231f46ba0e951610cc776813a

Code Sign

aa:f6:5b:8e:7a:2e:68:bc:8c:9e:8f:27:33:1b:79:5cCertificate

Extended Key Usages

Key Usages

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2dCertificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

ef:c0:37:29:b8:01:d1:94:8e:61:b4:a0:8d:bf:d6:9d:80:52:90:b8Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

comctl32

Sections

.text Size: 228KB - Virtual size: 228KB

.data Size: 8KB - Virtual size: 10KB

.rsrc Size: 2KB - Virtual size: 2KB

aa:f6:5b:8e:7a:2e:68:bc:8c:9e:8f:27:33:1b:79:5c
Certificate

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

ef:c0:37:29:b8:01:d1:94:8e:61:b4:a0:8d:bf:d6:9d:80:52:90:b8
Signer

.text
Size: 228KB - Virtual size: 228KB

.data
Size: 8KB - Virtual size: 10KB

.rsrc
Size: 2KB - Virtual size: 2KB