2024-10-14_c3e1aac0b182a5756b399daa19284092_cobalt-strike_megazord

Sharing

Copy URL Twitter E-mail

General

Target

2024-10-14_c3e1aac0b182a5756b399daa19284092_cobalt-strike_megazord
Size

21.7MB
MD5

c3e1aac0b182a5756b399daa19284092
SHA1

f2265561ff0f230057c0d768a5783aed2bb23203
SHA256

6019e74b9e867a1073c109b83ffb057da327cd298cb377d6c0facd0dc92da306
SHA512

1be111f22a184076dcf5036b323d1eb6a8c6452ad2059ab75bc488c008c223470874716f98391de8b77353fcf484fd6d10d0516f919384f016889b57cdeddaf1
SSDEEP

196608:ZQhOnsCISv7LEC2UWPAetApy9u8OrHJvcGxR69Sdi5C/:SOnsCISv0CpqV4y9uB9kGxR69SM5C/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-10-14_c3e1aac0b182a5756b399daa19284092_cobalt-strike_megazord

Files

2024-10-14_c3e1aac0b182a5756b399daa19284092_cobalt-strike_megazord
.exe windows:6 windows x64 arch:x64

d24825f71d08c24540d1a639e6feacbd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\ress\project\gai-pc-agent\src-tauri\target\release\deps\gai_pc_agent.pdb

Imports

kernel32

GetComputerNameExW
Sleep
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualUnlock
VirtualLock
VirtualProtect
GetSystemInfo
FormatMessageW
HeapAlloc
FreeLibrary
GetProcAddress
LoadLibraryA
LocalFree
CreateFileW
HeapFree
GetProcessHeap
VirtualAlloc
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetModuleHandleA
GetUserPreferredUILanguages
VirtualFree
GetCurrentProcessId
GetProcessTimes
lstrlenW
GetNativeSystemInfo
GetCurrentThreadId
TryAcquireSRWLockExclusive
CreateMutexA
WaitForSingleObjectEx
GetTempPathW
VirtualQueryEx
GlobalMemoryStatusEx
K32GetPerformanceInfo
GetExitCodeProcess
GetSystemTimeAsFileTime
GetCurrentThread
CreateThread
WaitForSingleObject
CreateEventA
AcquireSRWLockShared
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
OpenProcess
GetSystemTimes
GetProcessIoCounters
InitializeSListHead
IsDebuggerPresent
WriteConsoleW
ReadProcessMemory
MultiByteToWideChar
DeviceIoControl
SleepConditionVariableSRW
CreatePipe
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
GetConsoleMode
RtlVirtualUnwind
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
WaitForMultipleObjects
ReadFileEx
CreateNamedPipeW
SetHandleInformation
GetFullPathNameW
ExitProcess
CancelIo
CopyFileExW
GetFinalPathNameByHandleW
SetFileAttributesW
RemoveDirectoryW
MoveFileExW
DeleteFileW
FindFirstFileW
CreateDirectoryW
GetFileInformationByHandleEx
RtlUnwindEx
FindClose
RtlPcToFileHeader
FindNextFileW
HeapReAlloc
RaiseException
QueryPerformanceFrequency
EncodePointer
WakeConditionVariable
ReleaseSRWLockShared
GetUserDefaultUILanguage
LCIDToLocaleName
WakeAllConditionVariable
GetProcessId
TerminateProcess
SleepEx
WriteFileEx
GetStdHandle
SetFilePointerEx
SetFileInformationByHandle
LoadLibraryW
FlushFileBuffers
DeleteCriticalSection
GetCommandLineW
SetEnvironmentVariableW
GetEnvironmentStringsW
GetCurrentDirectoryW
SetLastError
RtlLookupFunctionEntry
RtlCaptureContext
TlsFree
QueryPerformanceCounter
SetWaitableTimer
CreateWaitableTimerExW
SwitchToThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
CompareStringOrdinal
DeleteProcThreadAttributeList
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
GetFileInformationByHandle
CreateEventW
LoadLibraryExA
TlsAlloc
GetModuleHandleW
SetFileCompletionNotificationModes
GetOverlappedResult
ReadFile
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
CreateIoCompletionPort
DuplicateHandle
GetCurrentProcess
GetFileAttributesW
OutputDebugStringA
OutputDebugStringW
GetModuleFileNameW
TlsGetValue
GetLastError
CreateMutexW
TlsSetValue
LoadLibraryExW
ReleaseMutex
GetEnvironmentVariableW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CloseHandle

user32

ShowWindow
RegisterWindowMessageA
EnumChildWindows
ReleaseDC
GetDC
ValidateRect
GetParent
SetWindowRgn
FindWindowExW
PostThreadMessageW
PeekMessageW
GetUpdateRect
DispatchMessageA
GetWindowLongW
GetClientRect
ClientToScreen
LoadCursorW
SetCursor
MonitorFromRect
PostMessageW
TrackMouseEvent
GetTouchInputInfo
ScreenToClient
MapWindowPoints
GetSystemMetrics
GetWindowRect
IsProcessDPIAware
GetCursorPos
MonitorFromWindow
SetWindowPos
GetMonitorInfoW
SetWindowsHookExW
SystemParametersInfoA
RegisterClassW
CallNextHookEx
GetMenuItemInfoW
SetPropW
RegisterRawInputDevices
DrawTextW
KillTimer
SetTimer
MsgWaitForMultipleObjectsEx
SetCapture
ReleaseCapture
FillRect
SystemParametersInfoW
TrackPopupMenu
RedrawWindow
TranslateAcceleratorW
GetWindowDC
OffsetRect
GetMenuBarInfo
EnumDisplayMonitors
MonitorFromPoint
PostQuitMessage
GetRawInputData
SetWindowTextW
CreateAcceleratorTableW
DestroyAcceleratorTable
GetWindowTextLengthW
SetParent
GetWindowTextW
SetWindowDisplayAffinity
SendMessageW
DefWindowProcW
DrawIconEx
CreateWindowExW
SetForegroundWindow
SetMenuItemInfoW
AppendMenuW
InsertMenuW
SendInput
GetKeyboardState
GetMessageA
GetAsyncKeyState
GetKeyState
MapVirtualKeyExW
CreatePopupMenu
GetKeyboardLayout
GetMenu
RegisterClassExW
AdjustWindowRectEx
DestroyWindow
ShowCursor
GetClipCursor
ClipCursor
CreateMenu
DestroyMenu
IsWindowVisible
GetWindowLongPtrW
SetWindowLongPtrW
RemoveMenu
GetSystemMenu
EnableMenuItem
FindWindowW
CreateIcon
ToUnicodeEx
DrawMenuBar
CloseTouchInputHandle
GetForegroundWindow
SetMenu
CheckMenuItem
RegisterTouchWindow
IsWindow
FlashWindowEx
GetActiveWindow
SetCursorPos
SetWindowLongW
InvalidateRgn
GetWindowPlacement
SetWindowPlacement
ChangeDisplaySettingsExW
DispatchMessageW
TranslateMessage
GetMessageW
MapVirtualKeyW
IsIconic
AdjustWindowRect
DestroyIcon

comctl32

SetWindowSubclass
TaskDialogIndirect
RemoveWindowSubclass
DefSubclassProc

ole32

CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity
CoUninitialize
RevokeDragDrop
CoTaskMemAlloc
RegisterDragDrop
OleInitialize
CoTaskMemFree
CoCreateInstance

shell32

ShellExecuteExW
SHCreateItemFromParsingName
Shell_NotifyIconW
CommandLineToArgvW
Shell_NotifyIconGetRect
SHAppBarMessage
DragFinish
DragQueryFileW
SHGetKnownFolderPath

ws2_32

closesocket
bind
connect
ioctlsocket
listen
accept
getsockname
getpeername
getsockopt
select
shutdown
recv
WSASocketW
send
WSASend
sendto
setsockopt
WSAIoctl
getaddrinfo
freeaddrinfo
WSACleanup
WSAStartup
WSAGetLastError

advapi32

RegGetValueW
EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
RegCloseKey
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
IsValidSid
GetLengthSid
CopySid
SystemFunction036
GetTokenInformation
OpenProcessToken

gdi32

SetTextColor
SetBkMode
SelectObject
CreateDIBSection
CombineRgn
CreateSolidBrush
CreateRectRgn
DeleteDC
DeleteObject
CreateCompatibleDC
BitBlt
GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow
DwmSetWindowAttribute
DwmGetWindowAttribute

oleaut32

SysFreeString
SysAllocStringLen
SetErrorInfo
SysStringLen
GetErrorInfo
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnaccessData
VariantClear

secur32

AcceptSecurityContext
InitializeSecurityContextW
FreeContextBuffer
EncryptMessage
ApplyControlToken
DecryptMessage
FreeCredentialsHandle
AcquireCredentialsHandleA
DeleteSecurityContext
QueryContextAttributesW

crypt32

CertFreeCertificateChain
CertDuplicateCertificateChain
CertEnumCertificatesInStore
CertDuplicateStore
CertAddCertificateContextToStore
CertDuplicateCertificateContext
CertOpenStore
CertCloseStore
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertGetCertificateChain

pdh

PdhRemoveCounter
PdhAddEnglishCounterW
PdhCollectQueryData
PdhOpenQueryA
PdhCloseQuery
PdhGetFormattedCounterValue

powrprof

CallNtPowerInformation

ntdll

NtCancelIoFileEx
RtlGetVersion
NtQuerySystemInformation
NtWriteFile
NtCreateFile
NtQueryInformationProcess
NtDeviceIoControlFile
NtReadFile
RtlNtStatusToDosError

iphlpapi

GetIfTable2
FreeMibTable
GetAdaptersAddresses

shlwapi

SHCreateMemStream

bcrypt

BCryptGenRandom

psapi

GetProcessMemoryInfo
GetModuleFileNameExW

api-ms-win-crt-math-l1-1-0

pow
__setusermatherr
trunc
ceil
log2
round
floor

api-ms-win-crt-string-l1-1-0

wcsncmp
wcscmp
wcslen
_wcsicmp
strlen
strcpy_s

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_crt_atexit
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_initialize_onexit_table
exit
_initterm_e
_initterm
terminate
abort
_errno
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
raise
_exit
_register_onexit_function
_set_app_type

api-ms-win-crt-heap-l1-1-0

free
calloc
malloc
_callnewh
realloc
_set_new_mode

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s
_wtoi

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 14.9MB - Virtual size: 14.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 720KB - Virtual size: 719KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d24825f71d08c24540d1a639e6feacbd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

comctl32

ole32

shell32

ws2_32

advapi32

gdi32

dwmapi

oleaut32

secur32

crypt32

pdh

powrprof

ntdll

iphlpapi

shlwapi

bcrypt

psapi

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 14.9MB - Virtual size: 14.9MB

.rdata Size: 5.9MB - Virtual size: 5.9MB

.data Size: 18KB - Virtual size: 30KB

.pdata Size: 720KB - Virtual size: 719KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 26KB - Virtual size: 25KB

.reloc Size: 84KB - Virtual size: 83KB

.text
Size: 14.9MB - Virtual size: 14.9MB

.rdata
Size: 5.9MB - Virtual size: 5.9MB

.data
Size: 18KB - Virtual size: 30KB

.pdata
Size: 720KB - Virtual size: 719KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 26KB - Virtual size: 25KB

.reloc
Size: 84KB - Virtual size: 83KB