2025-05-14_1652d7c80952a9ac54d59d4d2aedc182_black-basta_cobalt-strike_hijackloader_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2025-05-14_1652d7c80952a9ac54d59d4d2aedc182_black-basta_cobalt-strike_hijackloader_satacom
Size 349KB
Sample250514-a2wmlaspx9
SHA256 1980e370c276b65321018e736e20bc73d40090894d60bca4e428474cb13862ab
MD5 1652d7c80952a9ac54d59d4d2aedc182
SHA1 d0b51c295395913f836de488cded592a25383f58
SHA512 e65f1709faeb9445ce30f1e8e0b48f3fde2a7b52165dee0930b27512bc05502dc8a18c4566af6786a4fc66ae08a3646b997daf8fff9672c2502043c1a754d2d6
SSDEEP 6144:meGJSOoWzzmlPls4SUzT5FDhCohCVBwB9:mX1oW36eETYoMBwB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-05-14_1652d7c80952a9ac54d59d4d2aedc182_black-basta_cobalt-strike_hijackloader_satacom

File Explorer

2025-05-14_1652d7c80952a9ac54d59d4d2aedc182_black-basta_cobalt-strike_hijackloader_satacom

.exe 349KB

2025-05-14_1652d7c80952a9ac54d59d4d2aedc182_black-basta_cobalt-strike_hijackloader_satacom

IMPHASH 84691d90078a4ed47a0ed5732cf4d8b2
SHA256 1980e370c276b65321018e736e20bc73d40090894d60bca4e428474cb13862ab
MD5 1652d7c80952a9ac54d59d4d2aedc182
SHA1 d0b51c295395913f836de488cded592a25383f58
SHA512 e65f1709faeb9445ce30f1e8e0b48f3fde2a7b52165dee0930b27512bc05502dc8a18c4566af6786a4fc66ae08a3646b997daf8fff9672c2502043c1a754d2d6
SSDEEP 6144:meGJSOoWzzmlPls4SUzT5FDhCohCVBwB9:mX1oW36eETYoMBwB
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

360448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\PCGMR_BUILD\Cim\CiSrc\pdfconverter\pdfconverter\product\win32\PdfEditMenu.pdb

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW RegCloseKey RegQueryValueExW

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapSize HeapAlloc HeapFree HeapDestroy HeapReAlloc

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection ResetEvent ReleaseSemaphore CreateEventW SetEvent DeleteCriticalSection CreateSemaphoreExW ReleaseMutex WaitForSingleObjectEx WaitForSingleObject CreateMutexExW OpenSemaphoreW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW GetSystemTimeAsFileTime GetSystemDirectoryW

api-ms-win-core-errorhandling-l1-1-0

SetLastError RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW GetModuleFileNameW FreeLibrary GetProcAddress GetModuleHandleW LoadResource FreeLibraryAndExitThread GetModuleHandleExW GetModuleFileNameA FindResourceExW SizeofResource LockResource

api-ms-win-core-libraryloader-l1-2-1

FindResourceW LoadLibraryW

api-ms-win-core-file-l1-1-0

FindClose CreateDirectoryW GetFileSizeEx GetFileAttributesW GetFileType WriteFile FindFirstFileExW SetFilePointerEx ReadFile CreateFileW FlushFileBuffers FindNextFileW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle SetStdHandle GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineW SetEnvironmentVariableW

api-ms-win-core-processthreads-l1-1-0

TlsFree GetCurrentThreadId GetCurrentProcess TerminateProcess GetStartupInfoW TlsSetValue CreateThread GetCurrentProcessId ExitThread ExitProcess TlsGetValue TlsAlloc

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-localization-l1-2-0

IsValidCodePage GetACP GetUserDefaultLCID LCMapStringW GetLocaleInfoW GetCPInfo FormatMessageW EnumSystemLocalesW IsValidLocale GetOEMCP LCMapStringEx

api-ms-win-core-debug-l1-1-0

DebugBreak OutputDebugStringW IsDebuggerPresent

api-ms-win-core-privateprofile-l1-1-0

WritePrivateProfileStringW GetPrivateProfileStringW

api-ms-win-core-com-l1-1-0

CoIncrementMTAUsage CoTaskMemFree CoCreateFreeThreadedMarshaler

shell32

ShellExecuteExW SHGetKnownFolderPath

shlwapi

PathFileExistsW

version

GetFileVersionInfoSizeW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte GetStringTypeW MultiByteToWideChar CompareStringW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx RtlPcToFileHeader RtlUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedPushEntrySList

api-ms-win-core-console-l1-1-0

WriteConsoleW GetConsoleOutputCP ReadConsoleW GetConsoleMode

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

oleaut32

SysFreeString

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer WindowsDeleteString WindowsCreateStringReference

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

215KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.zero

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2025-05-14_1652d7c80952a9ac54d59d4d2aedc182_black-basta_cobalt-strike_hijackloader_satacom

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-com-l1-1-0

shell32

shlwapi

version

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-winrt-l1-1-0

oleaut32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

generic