cobaltstrike | f5c41aa19f5e2b5d98502714afd07455b9f9b33c59552d673ac2e6a839579725[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
f5c41aa19f5e2b5d98502714afd07455b9f9b33c59552d673ac2e6a839579725.zip
Size 105KB
Sample260720-d2dcssdz4q
SHA256 9244043acdcb1edf4ddee83d7d8e0e8c9d1ec135bab50f6b2da3d7abbce6df62
MD5 3afc7d6dd0e48780027815903d1c4d85
SHA1 575f78cc631a9835859a682ed203e0807ae2fbb2
SHA512 315f6d60f712551364e2754d610aec17081dc34c2a2820334573997f2b6fc1f162fbf237fe2779206f8cfb74aeba0f18ce386a42c468c3e681bb5c520a0b035b
SSDEEP 3072:PDP0zWDxPhje6Zr0Cz9Wm761jqc+gLD3DS89g:PL0zWDx5jehY9Wm7y/zHg
TLSH
T1D2B312F4943B045924A67A4FCD118218877772B636D862416A8DEFDE0A3D620F6BD0E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

Attributes

watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/f5c41aa19f5e2b5d98502714afd07455b9f9b33c59552d673ac2e6a839579725	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f5c41aa19f5e2b5d98502714afd07455b9f9b33c59552d673ac2e6a839579725

File Explorer

f5c41aa19f5e2b5d98502714afd07455b9f9b33c59552d673ac2e6a839579725.zip

.zip 105KB
f5c41aa19f5e2b5d98502714afd07455b9f9b33c59552d673ac2e6a839579725

.dll 210KB

f5c41aa19f5e2b5d98502714afd07455b9f9b33c59552d673ac2e6a839579725.zip

SHA256 9244043acdcb1edf4ddee83d7d8e0e8c9d1ec135bab50f6b2da3d7abbce6df62
MD5 3afc7d6dd0e48780027815903d1c4d85
SHA1 575f78cc631a9835859a682ed203e0807ae2fbb2
SHA512 315f6d60f712551364e2754d610aec17081dc34c2a2820334573997f2b6fc1f162fbf237fe2779206f8cfb74aeba0f18ce386a42c468c3e681bb5c520a0b035b
SSDEEP 3072:PDP0zWDxPhje6Zr0Cz9Wm761jqc+gLD3DS89g:PL0zWDx5jehY9Wm7y/zHg
TLSH
T1D2B312F4943B045924A67A4FCD118218877772B636D862416A8DEFDE0A3D620F6BD0E7
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

f5c41aa19f5e2b5d98502714afd07455b9f9b33c59552d673ac2e6a839579725

IMPHASH cee2783f5b537863eedf6975484fc19a
SHA256 f5c41aa19f5e2b5d98502714afd07455b9f9b33c59552d673ac2e6a839579725
MD5 7ab8ec41dd1c04bdc34c04de6e293d55
SHA1 f031834b8b54d7d0754858b449abc1d5419ecf89
SHA512 e79baf5b1a3c73864d9cd158da7e37d0986f94d9bcc560db48b0d5d6988a19527f095e93cccddcdb64f53d41748e0db2c3088b603e199e72c68f34286f3fd9f9
SSDEEP 3072:nDjMhZZ+d5wgexBvCg3GqUTmZwgwOhgVUq315WzrbL8Mbb:nDXejKa7UT3uhghE
TLSH
T131248DA13280D032D0570874621BC77E9FBDFDF416719487BBD45A66AE752A3EB2A303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

94033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

advapi32

GetUserNameA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

kernel32

MoveFileA FindNextFileA HeapAlloc HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx ProcessIdToSessionId VirtualProtect DuplicateHandle WriteProcessMemory GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError LoadLibraryA OpenThread CreateToolhelp32Snapshot SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA FindClose TerminateProcess Process32Next CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA CreateThread GetVersionExA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe GetEnvironmentVariableA CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile SetEnvironmentVariableW VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapSize DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateFileA GetCurrentProcessId GetLocalTime Sleep Process32First GetTickCount SetFilePointer GetFileType SetHandleCount GetConsoleMode GetModuleHandleW ExitProcess MultiByteToWideChar DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind WideCharToMultiByte GetConsoleCP

kernelbase

DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage

wininet

HttpQueryInfoA InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetQueryOptionA InternetOpenA

ws2_32

htons connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl htonl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket