cobaltstrike | 38711a8e26ae32710026c2e076b0eff578fe8b2c4fc2ebfc82021eb47bd6c53a[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
38711a8e26ae32710026c2e076b0eff578fe8b2c4fc2ebfc82021eb47bd6c53a.zip
Size 105KB
Sample260626-wal5qsdy2k
SHA256 7bab0031a5df190adc7f1d97d11c111a20e099c8a29b55bfe1a73af6a442ef3a
MD5 cb045255ca68dcb2ba534b24a3d10455
SHA1 5e1ad983c69628259887b9f6d82df9230088bd6c
SHA512 cc9da75786992a200a18e485ad35c6298f929de4773c4ead493907c9191e42230a233e0c55d49e1997c80c0f561ce368bb573cca0d762c2915f7864b1b4838de
SSDEEP 3072:8gWw9Z3TLua64YQJfccQdQ26iz4gYM5WlSx0o:JW63TLjZ5ccQdQ26J/QWG
TLSH
T101B31281E7B58AB1EA1EC69910FBCE89754F75C425CFB9D4E50447AC6FC80FD84A280B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

Attributes

watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/38711a8e26ae32710026c2e076b0eff578fe8b2c4fc2ebfc82021eb47bd6c53a	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/38711a8e26ae32710026c2e076b0eff578fe8b2c4fc2ebfc82021eb47bd6c53a

File Explorer

38711a8e26ae32710026c2e076b0eff578fe8b2c4fc2ebfc82021eb47bd6c53a.zip

.zip 105KB
38711a8e26ae32710026c2e076b0eff578fe8b2c4fc2ebfc82021eb47bd6c53a

.dll 210KB

38711a8e26ae32710026c2e076b0eff578fe8b2c4fc2ebfc82021eb47bd6c53a.zip

SHA256 7bab0031a5df190adc7f1d97d11c111a20e099c8a29b55bfe1a73af6a442ef3a
MD5 cb045255ca68dcb2ba534b24a3d10455
SHA1 5e1ad983c69628259887b9f6d82df9230088bd6c
SHA512 cc9da75786992a200a18e485ad35c6298f929de4773c4ead493907c9191e42230a233e0c55d49e1997c80c0f561ce368bb573cca0d762c2915f7864b1b4838de
SSDEEP 3072:8gWw9Z3TLua64YQJfccQdQ26iz4gYM5WlSx0o:JW63TLjZ5ccQdQ26J/QWG
TLSH
T101B31281E7B58AB1EA1EC69910FBCE89754F75C425CFB9D4E50447AC6FC80FD84A280B
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

38711a8e26ae32710026c2e076b0eff578fe8b2c4fc2ebfc82021eb47bd6c53a

IMPHASH cee2783f5b537863eedf6975484fc19a
SHA256 38711a8e26ae32710026c2e076b0eff578fe8b2c4fc2ebfc82021eb47bd6c53a
MD5 933c11e6143a55a6d773d7eb3ef889ad
SHA1 48eb6fd4b58d863263facbfcb5b04b7851e93a3e
SHA512 ad3e6d9ba843444208efafe2a0b7be354f0d8da4118316c6938a2ee00020d7d587b8404d646c39435df990c5155805826bc983d7569cd7571daf9ae63da1dfdc
SSDEEP 3072:ATbv99UKTxbBSFVtuTEHLD7kdAk+m2QhUDu215dmrbL8Mbb:ATbv9knMAHLD4n52QAm
TLSH
T1F5249DA17680D432D0670435521BC33F9ABDFDF02676A44BBBE41B565F352A3EB2A306
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

94033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

advapi32

GetUserNameA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

kernel32

MoveFileA FindNextFileA HeapAlloc HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx ProcessIdToSessionId VirtualProtect DuplicateHandle WriteProcessMemory GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError LoadLibraryA OpenThread CreateToolhelp32Snapshot SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA FindClose TerminateProcess Process32Next CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA CreateThread GetVersionExA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe GetEnvironmentVariableA CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile SetEnvironmentVariableW VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapSize DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateFileA GetCurrentProcessId GetLocalTime Sleep Process32First GetTickCount SetFilePointer GetFileType SetHandleCount GetConsoleMode GetModuleHandleW ExitProcess MultiByteToWideChar DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind WideCharToMultiByte GetConsoleCP

kernelbase

DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage

wininet

HttpQueryInfoA InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetQueryOptionA InternetOpenA

ws2_32

htons connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl htonl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket