cobaltstrike | 375d072aa04d58ecaa7413ed2fcf8b2bc51a0ae890cd491f93ba9f371a4afef6[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
375d072aa04d58ecaa7413ed2fcf8b2bc51a0ae890cd491f93ba9f371a4afef6.zip
Size 105KB
Sample260730-snk8tabe77
SHA256 025194807ae7116f1fc6edb6103ccd6d83858335af79571c2da60b0705b575d9
MD5 b842cae39913d701f2bd22504992c4a1
SHA1 c0a4763bf96eacef687f369fad6d1194fdb25681
SHA512 80dde4a9ac84c38310709047648dc86ca8e5f9fdd96e84e3f3159653c26025a31aa06ed78fd2ce0f69927be2d7f6a3a19bca9e3c66f574c60623c5b30a7528d2
SSDEEP 3072:iCAvuq5s7sdK9ANEqIJkLAvgvJtEefSA3KZ/YKNpP024l:jAHp2qIKAvgvJtEsJ9KNN02I
TLSH
T1E7B312032F63A6A219C3FF7D461872F004AB983597809F19EB5E51A9577E1BE093B730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

Attributes

watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/375d072aa04d58ecaa7413ed2fcf8b2bc51a0ae890cd491f93ba9f371a4afef6	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/375d072aa04d58ecaa7413ed2fcf8b2bc51a0ae890cd491f93ba9f371a4afef6

File Explorer

375d072aa04d58ecaa7413ed2fcf8b2bc51a0ae890cd491f93ba9f371a4afef6.zip

.zip 105KB
375d072aa04d58ecaa7413ed2fcf8b2bc51a0ae890cd491f93ba9f371a4afef6

.dll 210KB

375d072aa04d58ecaa7413ed2fcf8b2bc51a0ae890cd491f93ba9f371a4afef6.zip

SHA256 025194807ae7116f1fc6edb6103ccd6d83858335af79571c2da60b0705b575d9
MD5 b842cae39913d701f2bd22504992c4a1
SHA1 c0a4763bf96eacef687f369fad6d1194fdb25681
SHA512 80dde4a9ac84c38310709047648dc86ca8e5f9fdd96e84e3f3159653c26025a31aa06ed78fd2ce0f69927be2d7f6a3a19bca9e3c66f574c60623c5b30a7528d2
SSDEEP 3072:iCAvuq5s7sdK9ANEqIJkLAvgvJtEefSA3KZ/YKNpP024l:jAHp2qIKAvgvJtEsJ9KNN02I
TLSH
T1E7B312032F63A6A219C3FF7D461872F004AB983597809F19EB5E51A9577E1BE093B730
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

375d072aa04d58ecaa7413ed2fcf8b2bc51a0ae890cd491f93ba9f371a4afef6

IMPHASH cee2783f5b537863eedf6975484fc19a
SHA256 375d072aa04d58ecaa7413ed2fcf8b2bc51a0ae890cd491f93ba9f371a4afef6
MD5 d982331a645ca4e2f25f9c7b1e7b38dc
SHA1 7bfd77b4cad06dd4acd85cdfa72043b1e1d2b692
SHA512 c707a749cce729652e75c680f0751fed64f12a27225da0fc2d4587812b5c55d956525dc536b3b9034251de09a79a6e50c732077c68348981fa432ae000ccfd7e
SSDEEP 3072:B5Nuf5qXZCeQB0SLQakuRWLuMS0qxQ9U0315lIrbL8Mbb:BnfE10S0zuRWLZgxQjQ
TLSH
T123248CA535D2D032D4571474620AC77E9ABDFCF41632A443BBC81A5A5F762E3EB3A302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

94033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

advapi32

GetUserNameA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

kernel32

MoveFileA FindNextFileA HeapAlloc HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx ProcessIdToSessionId VirtualProtect DuplicateHandle WriteProcessMemory GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError LoadLibraryA OpenThread CreateToolhelp32Snapshot SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA FindClose TerminateProcess Process32Next CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA CreateThread GetVersionExA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe GetEnvironmentVariableA CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile SetEnvironmentVariableW VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapSize DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateFileA GetCurrentProcessId GetLocalTime Sleep Process32First GetTickCount SetFilePointer GetFileType SetHandleCount GetConsoleMode GetModuleHandleW ExitProcess MultiByteToWideChar DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind WideCharToMultiByte GetConsoleCP

kernelbase

DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage

wininet

HttpQueryInfoA InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetQueryOptionA InternetOpenA

ws2_32

htons connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl htonl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket