2024-10-13_9dad305ee8bfbf8ad6f33de2de21b06f_cobalt-strike_megazord

Sharing

Copy URL Twitter E-mail

General

Target

2024-10-13_9dad305ee8bfbf8ad6f33de2de21b06f_cobalt-strike_megazord
Size

14.6MB
MD5

9dad305ee8bfbf8ad6f33de2de21b06f
SHA1

d51280fa8c3f71689ae3bd7f2a2eeb6d416f1f86
SHA256

474a33f8ee1f435d36bc12911d61deb285897f652107e17fc42b202f3a079046
SHA512

6bda64ff8d8ef52a001ecf5e6909484eb4d6fb7c02b631868a89276c3405edac598e049ca95da525ef858450539ac68ba16aac219c7772a95a291e990426dadd
SSDEEP

196608:I3e439qcLO4DOyvek4JELDzDSlYm4QV3j8rqNS:WdKErLDzDSCm4QV3j8rqNS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-10-13_9dad305ee8bfbf8ad6f33de2de21b06f_cobalt-strike_megazord

Files

2024-10-13_9dad305ee8bfbf8ad6f33de2de21b06f_cobalt-strike_megazord
.exe windows:6 windows x64 arch:x64

31d49736e8e51fb45e62a0baa554a5da

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

SleepEx
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
CreateProcessW
DuplicateHandle
CreateThread
GetCurrentThread
WriteFileEx
WaitForMultipleObjects
CreateEventW
CancelIo
ExitProcess
QueryPerformanceFrequency
RtlCaptureContext
FindFirstFileW
DeleteFileW
MoveFileExW
RemoveDirectoryW
CreateSymbolicLinkW
SetHandleInformation
GetComputerNameExW
VerSetConditionMask
ProcessIdToSessionId
OpenProcess
VerifyVersionInfoW
WTSGetActiveConsoleSessionId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
LoadLibraryExW
WideCharToMultiByte
GetSystemTime
GetLocalTime
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
ResetEvent
CreateSemaphoreW
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetComputerNameW
CompareStringW
GetNumberFormatW
GetCurrencyFormatW
GetSystemDefaultLCID
GetUserDefaultLCID
OutputDebugStringW
MulDiv
GetTempPathA
GetTempFileNameA
AllocConsole
GetModuleFileNameA
LoadLibraryExA
DebugBreak
FormatMessageA
SetErrorMode
GetQueuedCompletionStatus
GetFileType
RegisterWaitForSingleObject
UnregisterWait
SetNamedPipeHandleState
PeekNamedPipe
GetNamedPipeHandleStateW
QueueUserWorkItem
GetFileSize
SetEndOfFile
SetFilePointer
CreateFileMappingW
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
GetCPInfo
FreeLibrary
LocalSize
CreateFileA
GetNumberOfConsoleInputEvents
ReadConsoleInputW
CreateDirectoryW
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
WriteConsoleInputW
UnregisterWaitEx
LCMapStringW
CopyFileW
CreateHardLinkW
GetLongPathNameW
GetShortPathNameW
ReadDirectoryChangesW
DecodePointer
RaiseException
InitializeCriticalSectionEx
GetLogicalDriveStringsW
GetVolumeInformationW
GetStartupInfoW
LoadLibraryW
lstrcmpW
SetThreadPriority
GetThreadPriority
GetTickCount
GetVersionExW
GetFileTime
WakeConditionVariable
SleepConditionVariableCS
InitializeConditionVariable
WakeAllConditionVariable
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetFileSizeEx
EnumSystemLocalesW
IsValidLocale
GetCommandLineA
GetConsoleOutputCP
SetFileAttributesW
GetFileAttributesExW
SetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
InitializeCriticalSectionAndSpinCount
RtlUnwind
RtlUnwindEx
GetStringTypeW
LCMapStringEx
EncodePointer
SleepConditionVariableSRW
InitializeSRWLock
GetNativeSystemInfo
GetExitCodeThread
RtlPcToFileHeader
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
ReadFileEx
GetFullPathNameW
FindNextFileW
DeviceIoControl
GetFileInformationByHandle
GetCommandLineW
GetModuleFileNameW
GetTempPathW
SetEnvironmentVariableW
GetEnvironmentVariableW
RtlLookupFunctionEntry
ReleaseMutex
GetCurrentProcess
CreateMutexA
LoadLibraryA
WaitForSingleObjectEx
GetCurrentDirectoryW
WriteConsoleW
GetProcAddress
GetModuleHandleA
CreateNamedPipeW
SetFileCompletionNotificationModes
CreateIoCompletionPort
CancelIoEx
WriteFile
PostQueuedCompletionStatus
GetOverlappedResult
ReadFile
TryAcquireSRWLockExclusive
GetFinalPathNameByHandleW
SetLastError
GetQueuedCompletionStatusEx
SetConsoleCtrlHandler
CreateSemaphoreA
TerminateProcess
GetUserDefaultLocaleName
GetModuleHandleW
GetCurrentThreadId
GlobalFree
GlobalAlloc
MultiByteToWideChar
WaitForSingleObject
GlobalSize
GlobalUnlock
GlobalLock
GetSystemInfo
GetLogicalProcessorInformation
FlushFileBuffers
LocalAlloc
ConnectNamedPipe
GetExitCodeProcess
LocalFree
SetFileTime
GetLogicalDrives
ReleaseSRWLockShared
AcquireSRWLockShared
GetTimeZoneInformation
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FormatMessageW
lstrlenW
ReleaseSemaphore
QueryPerformanceCounter
WaitForMultipleObjectsEx
SetEvent
CreateEventA
SetFilePointerEx
GetFileInformationByHandleEx
GetStdHandle
HeapReAlloc
SetThreadStackGuarantee
AddVectoredExceptionHandler
Sleep
GetLastError
SetConsoleMode
GetConsoleMode
CreateFileW
GetSystemTimeAsFileTime
GetCurrentProcessId
CloseHandle
SwitchToThread
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
FindClose
HeapAlloc
GetProcessHeap
ReadConsoleW
HeapFree
HeapSize

sas

SendSAS

wtsapi32

WTSQuerySessionInformationW
WTSEnumerateSessionsA
WTSFreeMemory

secur32

AcquireCredentialsHandleA
DecryptMessage
QueryContextAttributesW
InitializeSecurityContextW
AcceptSecurityContext
ApplyControlToken
EncryptMessage
FreeCredentialsHandle
DeleteSecurityContext
FreeContextBuffer

ole32

PropVariantClear
RegisterDragDrop
RevokeDragDrop
DoDragDrop
ReleaseStgMedium
CoInitializeEx
CoTaskMemAlloc
CoFreeUnusedLibraries
CoInitialize
OleSetClipboard
OleGetClipboard
OleIsCurrentClipboard
CoUninitialize
CoTaskMemFree
CoCreateInstance
OleInitialize
CoCreateGuid
CreateStreamOnHGlobal
OleUninitialize

user32

MapVirtualKeyW
SetWinEventHook
UpdateLayeredWindow
GetQueueStatus
MsgWaitForMultipleObjects
DispatchMessageA
DefWindowProcA
RegisterClassExA
CreateWindowExA
GetClipboardOwner
EnumClipboardFormats
ChangeClipboardChain
RegisterClipboardFormatA
GetClipboardFormatNameA
GetClientRect
EnableWindow
IsWindowUnicode
KillTimer
SetTimer
ReleaseCapture
CreateIconIndirect
UpdateWindow
CountClipboardFormats
RegisterClipboardFormatW
GetClipboardSequenceNumber
FindWindowW
SetCaretPos
DestroyCaret
CreateCaret
MessageBoxW
SetActiveWindow
SetClipboardViewer
LoadStringW
SendInput
GetForegroundWindow
GetWindowThreadProcessId
GetKeyboardLayout
MapVirtualKeyExW
VkKeyScanExW
SetCapture
GetCapture
GetFocus
GetActiveWindow
SetFocus
CallMsgFilterW
IsIconic
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetWindowPlacement
MoveWindow
FlashWindowEx
DestroyWindow
IsChild
IsWindow
GetDesktopWindow
GetMessageTime
RegisterWindowMessageW
MessageBoxA
GetWindowTextW
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
DestroyCursor
LoadCursorFromFileA
LoadCursorW
GetSysColor
UnhookWindowsHookEx
GetAsyncKeyState
PostMessageA
SendMessageA
PeekMessageA
GetUserObjectInformationA
GetThreadDesktop
CloseDesktop
SetThreadDesktop
OpenInputDesktop
RegisterClassExW
GetKeyState
LockWorkStation
GetCursorPos
GetCursorInfo
MapVirtualKeyA
EnumDisplaySettingsExW
EnumDisplayDevicesW
CallNextHookEx
ToUnicodeEx
GetSystemMetrics
BlockInput
MsgWaitForMultipleObjectsEx
GetUpdateRect
PostThreadMessageW
PeekMessageW
ValidateRect
GetRawInputData
TrackPopupMenu
SetForegroundWindow
DefWindowProcW
PostMessageW
GetWindowLongPtrW
RegisterWindowMessageA
DestroyMenu
AppendMenuW
CreatePopupMenu
SendMessageW
InvalidateRgn
SetWindowPos
AdjustWindowRectEx
GetMenu
GetWindowLongW
RedrawWindow
RegisterClassW
CopyIcon
DestroyIcon
CreateIconFromResourceEx
LookupIconIdFromDirectoryEx
RegisterRawInputDevices
SetWindowLongPtrW
CreateWindowExW
DispatchMessageW
TranslateMessage
GetMessageW
ShowWindow
SetWindowTextW
GetMessageA
EndPaint
BeginPaint
IsWindowEnabled
AnimateWindow
MessageBeep
GetDoubleClickTime
NotifyWinEvent
MonitorFromPoint
GetScrollInfo
SetScrollInfo
LoadIconW
SetWindowsHookExW
GetWindow
EnumThreadWindows
GetParent
SetClassLongW
GetClassLongW
SetWindowLongW
IsRectEmpty
WindowFromPoint
MapWindowPoints
ScreenToClient
ClientToScreen
SetCursor
PostQuitMessage
GetIconInfo
GetDC
ReleaseDC
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
SetWindowsHookExA
GetWindowRect
EnumDisplayMonitors
InvalidateRect
DrawIconEx

comdlg32

GetOpenFileNameW
PrintDlgW
GetSaveFileNameW
CommDlgExtendedError

wininet

InternetOpenA
InternetConnectA
InternetErrorDlg
HttpQueryInfoW
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionW
InternetQueryOptionW
InternetReadFile
InternetCloseHandle

bcrypt

BCryptGenRandom

ntdll

NtDeviceIoControlFile
NtCancelIoFileEx
RtlNtStatusToDosError
NtCreateFile

advapi32

OpenServiceW
SystemFunction036
CryptGenRandom
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
FreeSid
SetSecurityDescriptorDacl
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetUserNameW
OpenSCManagerW
CryptReleaseContext
CloseServiceHandle
CreateProcessAsUserW
OpenProcessToken
CryptAcquireContextW

comctl32

ImageList_Destroy
ImageList_GetIconSize
ord410
ord412
ord413
ImageList_DrawEx

crypt32

CertCloseStore
CertDuplicateCertificateContext
CertOpenStore
CertAddCertificateContextToStore
CertDuplicateStore
CertEnumCertificatesInStore
CertGetCertificateChain
CertDuplicateCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateContext

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

gdi32

DeleteDC
DeleteObject
BitBlt
GetDIBits
GetObjectA
GetBitmapBits
CreateCompatibleDC
CreateDCW
CreateCompatibleBitmap
GetDeviceCaps
AddFontMemResourceEx
GetObjectW
SetMapMode
StartDocW
EndDoc
StartPage
EndPage
CreateSolidBrush
GetStockObject
SetLayout
CreateDIBSection
CreateBitmap
GetGlyphIndicesW
CreateFontW
EnumFontFamiliesExW
GetFontUnicodeRanges
StretchDIBits
GetClipBox
RestoreDC
SaveDC
SetViewportOrgEx
SelectObject

imm32

ImmGetContext
ImmReleaseContext
ImmAssociateContextEx
ImmGetCompositionStringW
ImmNotifyIME
ImmSetCandidateWindow
ImmIsIME

iphlpapi

GetAdaptersAddresses

oleaut32

SysAllocStringLen
SysFreeString
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreateVector

shell32

ShellExecuteExW
SHAddToRecentDocs
CommandLineToArgvW
SHGetKnownFolderPath
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ord727
ord74
DragQueryFileW
ShellExecuteW
SHGetSpecialFolderPathW
Shell_NotifyIconW

shlwapi

PathIsRelativeW

uxtheme

GetThemePartSize
OpenThemeData
SetWindowTheme
IsThemeBackgroundPartiallyTransparent
CloseThemeData
DrawThemeBackground

winspool.drv

ord203

ws2_32

WSARecvFrom
WSARecv
htons
WSASend
send
recv
WSACleanup
freeaddrinfo
select
WSASetLastError
WSASocketW
getaddrinfo
WSAIoctl
recvfrom
sendto
bind
listen
socket
ioctlsocket
setsockopt
closesocket
WSAStartup
getsockopt
shutdown
connect
getsockname
WSAGetLastError
getpeername
accept

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

gdiplus

GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipCreateFromHDC
GdipCreateFromHWND
GdipDeleteGraphics
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipGetSmoothingMode
GdipSetPixelOffsetMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipResetWorldTransform
GdipMultiplyWorldTransform
GdipTranslateWorldTransform
GdipGetWorldTransform
GdipSetPageUnit
GdipTransformPoints
GdipDrawLine
GdipCreatePen1
GdipDrawRectangle
GdipDrawEllipse
GdipDrawPie
GdipDrawPath
GdipGraphicsClear
GdipFillRectangle
GdipFillRectangleI
GdipFillRectanglesI
GdipFillEllipse
GdipFillPie
GdipFillPath
GdipDrawImageRectRect
GdipSetClipRect
GdipSetClipRectI
GdipGetClipBoundsI
GdipSaveGraphics
GdipRestoreGraphics
GdipCloneImage
GdipSetPenMiterLimit
GdiplusStartup
GdiplusShutdown
GdipDeleteFontFamily
GdipGetEmHeight
GdipGetCellAscent
GdipGetLineSpacing
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipGetFamily
GdipGetFontSize
GdipCreateBitmapFromGraphics
GdipCreateHBITMAPFromBitmap
GdipDrawImageI
GdipDrawDriverString
GdipSetPenLineJoin
GdipSetPathGradientTransform
GdipSetPathGradientWrapMode
GdipSetPathGradientPresetBlend
GdipSetPathGradientCenterPoint
GdipCreatePathGradientFromPath
GdipMultiplyLineTransform
GdipSetLineWrapMode
GdipSetLinePresetBlend
GdipCreateLineBrush
GdipCreateSolidFill
GdipCreateTexture
GdipDeleteBrush
GdipCloneBrush
GdipGetMatrixElements
GdipShearMatrix
GdipRotateMatrix
GdipScaleMatrix
GdipTranslateMatrix
GdipDeleteMatrix
GdipCreateMatrix2
GdipCreateMatrix
GdipIsVisiblePathPoint
GdipGetPathWorldBounds
GdipAddPathRectangleI
GdipAddPathArcI
GdipAddPathLineI
GdipAddPathEllipse
GdipDisposeImage
GdipSetPenDashOffset
GdipSetPenDashArray
GdipBeginContainer2
GdipAlloc
GdipFree
GdipSetPenEndCap
GdipSetPenStartCap
GdipDeletePen
GdipSetPenDashStyle
GdipEndContainer
GdipCreatePath
GdipClonePath
GdipDeletePath
GdipResetPath
GdipSetPathFillMode
GdipStartPathFigure
GdipClosePathFigure
GdipAddPathLine
GdipAddPathArc
GdipAddPathBezier
GdipCreatePen2
GdipDrawArc

winmm

timeEndPeriod
timeBeginPeriod
timeGetTime
timeKillEvent
timeSetEvent

oleacc

AccessibleObjectFromWindow
LresultFromObject

usp10

ScriptApplyDigitSubstitution
ScriptFreeCache
ScriptItemize
ScriptShape
ScriptPlace
ScriptBreak

Sections

.text
Size: 10.7MB - Virtual size: 10.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 348KB - Virtual size: 348KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 296KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

31d49736e8e51fb45e62a0baa554a5da

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

sas

wtsapi32

secur32

ole32

user32

comdlg32

wininet

bcrypt

ntdll

advapi32

comctl32

crypt32

d3d11

dxgi

gdi32

imm32

iphlpapi

oleaut32

shell32

shlwapi

uxtheme

winspool.drv

ws2_32

userenv

gdiplus

winmm

oleacc

usp10

Sections

.text Size: 10.7MB - Virtual size: 10.7MB

.rdata Size: 3.1MB - Virtual size: 3.1MB

.data Size: 348KB - Virtual size: 348KB

.pdata Size: 296KB - Virtual size: 296KB

_RDATA Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 156KB - Virtual size: 156KB

.text
Size: 10.7MB - Virtual size: 10.7MB

.rdata
Size: 3.1MB - Virtual size: 3.1MB

.data
Size: 348KB - Virtual size: 348KB

.pdata
Size: 296KB - Virtual size: 296KB

_RDATA
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 156KB - Virtual size: 156KB