2026-04-03_da9714db119c4c724678db136c3c5b39_cobalt-strike_mountlocker

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-03_da9714db119c4c724678db136c3c5b39_cobalt-strike_mountlocker
Size 75KB
Sample260403-j128esfw4x
SHA256 2ca3db6ed97fe6759dc19a4faba5b94e72fb0e1b226293b775d546152311a7df
MD5 da9714db119c4c724678db136c3c5b39
SHA1 2d510d7381c8132592b9bc43ab07e339314f6648
SHA512 b08079514e77445389f83f9839a134940cc095ddd9642748a4f1886f9e9941d6c0c3936962428feca76199e7cfe4ccbd65b6ed3ae4b9c3097568e9aa463dc353
SSDEEP 768:FIzkUtPX9DUetap1YOc8tmmSuDsCHJexou+nPp18vjILhussGdamRv5qmppQHUd:LaX1LGfDpRRuI0PuvtOuSG4z
TLSH
T102737C4E96F100F9C51BF135C4B24A3BD3B1F46951B8820F17AED6A1AFB33624E0AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-03_da9714db119c4c724678db136c3c5b39_cobalt-strike_mountlocker

File Explorer

2026-04-03_da9714db119c4c724678db136c3c5b39_cobalt-strike_mountlocker

.exe 75KB

2026-04-03_da9714db119c4c724678db136c3c5b39_cobalt-strike_mountlocker

IMPHASH 200928216c27c7644c19b0beec4e3fd5
SHA256 2ca3db6ed97fe6759dc19a4faba5b94e72fb0e1b226293b775d546152311a7df
MD5 da9714db119c4c724678db136c3c5b39
SHA1 2d510d7381c8132592b9bc43ab07e339314f6648
SHA512 b08079514e77445389f83f9839a134940cc095ddd9642748a4f1886f9e9941d6c0c3936962428feca76199e7cfe4ccbd65b6ed3ae4b9c3097568e9aa463dc353
SSDEEP 768:FIzkUtPX9DUetap1YOc8tmmSuDsCHJexou+nPp18vjILhussGdamRv5qmppQHUd:LaX1LGfDpRRuI0PuvtOuSG4z
TLSH
T102737C4E96F100F9C51BF135C4B24A3BD3B1F46951B8820F17AED6A1AFB33624E0AB15
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

oleaut32

SysAllocString SysFreeString

mpr

WNetCancelConnection2W WNetOpenEnumW WNetEnumResourceW WNetCloseEnum WNetAddConnection2W

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoInitializeSecurity

user32

wsprintfW

netapi32

NetApiBufferFree NetShareEnum NetGetJoinInformation NetGetDCName

ntdll

RtlGetNativeSystemInformation RtlVirtualUnwind RtlGetVersion ZwQuerySystemInformation

advapi32

GetUserNameW LookupAccountSidW GetTokenInformation LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken StartServiceW QueryServiceStatusEx OpenServiceA OpenSCManagerW OpenSCManagerA EnumServicesStatusA DeleteService CreateServiceW ControlService CloseServiceHandle CryptEncrypt CryptImportKey CryptDestroyKey CryptReleaseContext CryptAcquireContextW

activeds

ord9

msvcrt

feof fgetws _getch fclose _vsnwprintf memset _wfopen

shell32

CommandLineToArgvW ord680

shlwapi

StrStrIW SHRegSetUSValueW StrChrW StrCmpIW StrStrIA StrCmpNIW

kernel32

DeleteFileW GlobalMemoryStatus CopyFileW GetStdHandle WaitForSingleObject CreateEventA CreateThread GetTickCount64 CreateSemaphoreA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection AllocConsole WriteConsoleW GetConsoleScreenBufferInfo SetFileAttributesW DeviceIoControl lstrcmpiW ResetEvent TerminateThread GetFileSizeEx ReadFile SetConsoleCursorPosition GetComputerNameW lstrcmpiA GetSystemInfo CreateProcessW GetTempPathW GetModuleFileNameW SetEndOfFile OpenProcess TerminateProcess GetComputerNameA lstrlenA TlsAlloc SetErrorMode ExitProcess ReleaseSemaphore SetEvent GetCommandLineW GetDriveTypeW TlsSetValue TlsGetValue SetFilePointerEx SetFileInformationByHandle GetCurrentProcess HeapAlloc GetProcessHeap lstrcpyW lstrcatW lstrlenW FindClose FindFirstFileW FindNextFileW GetVolumeInformationW GetLastError HeapFree CreateFileW WriteFile CloseHandle SetLastError HeapReAlloc GetCurrentProcessId WideCharToMultiByte Sleep GetTickCount QueryPerformanceCounter QueryPerformanceFrequency

Name

.text

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-03_da9714db119c4c724678db136c3c5b39_cobalt-strike_mountlocker

oleaut32

mpr

ole32

user32

netapi32

ntdll

advapi32

activeds

msvcrt

shell32

shlwapi

kernel32

generic