cobaltstrike | a62bafa0625019257fff1062661ec7de7ee125673b54d7d6353d62f219757281[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
a62bafa0625019257fff1062661ec7de7ee125673b54d7d6353d62f219757281.zip
Size 105KB
Sample260512-nd6pjsfz2n
SHA256 d2bbeff62a406d6828112d7a9e2fb46497990506fa73b71a686075cf1feb6311
MD5 3649602d6a4c45331d0f6994cd5cc67c
SHA1 f730f7d560fc7d03cad007962067ffa4b2b6a165
SHA512 7a7fd1ddeaa75f71a9bf39eab6c740bb7d8feb5592cf74e8950d3ca21fbe8845d506407aa3eb0478afa3e4d5bd98d3a499ceea06293600c29bd12262d6d84886
SSDEEP 1536:DSIsak5NwghoK4Cbi3MhQqMQ63dNRZjdXGqYlam4mB2m8L4UGpoV6E2CIJzRW4Ny:H6vTDbicCFULZDyzQrh51liqmJCjS
TLSH
T121B3124322A110EBB5673838A521708BBEF85F4D784AC6CEBD9EDC734DA7096035E54B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

Attributes

watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/a62bafa0625019257fff1062661ec7de7ee125673b54d7d6353d62f219757281	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a62bafa0625019257fff1062661ec7de7ee125673b54d7d6353d62f219757281

File Explorer

a62bafa0625019257fff1062661ec7de7ee125673b54d7d6353d62f219757281.zip

.zip 105KB
a62bafa0625019257fff1062661ec7de7ee125673b54d7d6353d62f219757281

.dll 210KB

a62bafa0625019257fff1062661ec7de7ee125673b54d7d6353d62f219757281.zip

SHA256 d2bbeff62a406d6828112d7a9e2fb46497990506fa73b71a686075cf1feb6311
MD5 3649602d6a4c45331d0f6994cd5cc67c
SHA1 f730f7d560fc7d03cad007962067ffa4b2b6a165
SHA512 7a7fd1ddeaa75f71a9bf39eab6c740bb7d8feb5592cf74e8950d3ca21fbe8845d506407aa3eb0478afa3e4d5bd98d3a499ceea06293600c29bd12262d6d84886
SSDEEP 1536:DSIsak5NwghoK4Cbi3MhQqMQ63dNRZjdXGqYlam4mB2m8L4UGpoV6E2CIJzRW4Ny:H6vTDbicCFULZDyzQrh51liqmJCjS
TLSH
T121B3124322A110EBB5673838A521708BBEF85F4D784AC6CEBD9EDC734DA7096035E54B
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

a62bafa0625019257fff1062661ec7de7ee125673b54d7d6353d62f219757281

IMPHASH cee2783f5b537863eedf6975484fc19a
SHA256 a62bafa0625019257fff1062661ec7de7ee125673b54d7d6353d62f219757281
MD5 69d9261b26bd8bd400bb7d5c4f7eafd7
SHA1 8fa0656b7dfdc9328280f18fa7baf62614be7ff3
SHA512 b27289f7267a5754f41c2567ca4410fcd631f58008ee870413bc7946ab37a36d8a22cdafafea25fab51f22d89d610ce5d7fa216b86d72981ba153b4808158b93
SSDEEP 3072:ATbv99UKTxbBSFVtuTEHLD7kdAk+m2QhUDu215dVrbL8Mbb:ATbv9knMAHLD4n52QAD
TLSH
T106249DA17680D432D0670435521BC33F9ABDFDF01276A44BBBE41A569F352A3EB2A306
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

94033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

advapi32

GetUserNameA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

kernel32

MoveFileA FindNextFileA HeapAlloc HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx ProcessIdToSessionId VirtualProtect DuplicateHandle WriteProcessMemory GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError LoadLibraryA OpenThread CreateToolhelp32Snapshot SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA FindClose TerminateProcess Process32Next CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA CreateThread GetVersionExA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe GetEnvironmentVariableA CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile SetEnvironmentVariableW VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapSize DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateFileA GetCurrentProcessId GetLocalTime Sleep Process32First GetTickCount SetFilePointer GetFileType SetHandleCount GetConsoleMode GetModuleHandleW ExitProcess MultiByteToWideChar DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind WideCharToMultiByte GetConsoleCP

kernelbase

DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage

wininet

HttpQueryInfoA InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetQueryOptionA InternetOpenA

ws2_32

htons connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl htonl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket