cobaltstrike | 3929f6fbd29021b919a896b4d3438ebf72c020fc1e3928dc32bcd412d4c1b349[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
3929f6fbd29021b919a896b4d3438ebf72c020fc1e3928dc32bcd412d4c1b349.zip
Size 105KB
Sample260731-ey79fawsbt
SHA256 6f5a879247926fa87a5897fa71167a9497a27c2c130a44d534f9f7af8a7a6732
MD5 2081d16013282e9a9e3bd117ff2d89a2
SHA1 6a4b7acb1f9b64a966f790e2f1fe0a8ba2a224ce
SHA512 cd0126d204c7b19e56e93e4178aa176e04086fbcf5828f1d8d3d35057e0757d8c831bbf7e23dc39daea78f389481e2eba88c70716b583b0234a95c317e51e639
SSDEEP 3072:H54H3oEQ66LTEklDg+CiGqwdRpPBJm6Aoihhr:ZuW66LTlDgji+RJrRA/r
TLSH
T1AFB312643CB55809D28D21B3664235FF087A50C54F4CFB9AA883897469BCC6E8BB5F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

Attributes

watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/3929f6fbd29021b919a896b4d3438ebf72c020fc1e3928dc32bcd412d4c1b349	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3929f6fbd29021b919a896b4d3438ebf72c020fc1e3928dc32bcd412d4c1b349

File Explorer

3929f6fbd29021b919a896b4d3438ebf72c020fc1e3928dc32bcd412d4c1b349.zip

.zip 105KB
3929f6fbd29021b919a896b4d3438ebf72c020fc1e3928dc32bcd412d4c1b349

.dll 210KB

3929f6fbd29021b919a896b4d3438ebf72c020fc1e3928dc32bcd412d4c1b349.zip

SHA256 6f5a879247926fa87a5897fa71167a9497a27c2c130a44d534f9f7af8a7a6732
MD5 2081d16013282e9a9e3bd117ff2d89a2
SHA1 6a4b7acb1f9b64a966f790e2f1fe0a8ba2a224ce
SHA512 cd0126d204c7b19e56e93e4178aa176e04086fbcf5828f1d8d3d35057e0757d8c831bbf7e23dc39daea78f389481e2eba88c70716b583b0234a95c317e51e639
SSDEEP 3072:H54H3oEQ66LTEklDg+CiGqwdRpPBJm6Aoihhr:ZuW66LTlDgji+RJrRA/r
TLSH
T1AFB312643CB55809D28D21B3664235FF087A50C54F4CFB9AA883897469BCC6E8BB5F23
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

3929f6fbd29021b919a896b4d3438ebf72c020fc1e3928dc32bcd412d4c1b349

IMPHASH cee2783f5b537863eedf6975484fc19a
SHA256 3929f6fbd29021b919a896b4d3438ebf72c020fc1e3928dc32bcd412d4c1b349
MD5 b111ce41c375a45514be1d2191714f31
SHA1 f105f3d2d974ee471f07f9b373dda8d46cd23f9f
SHA512 f0e5bf4eb05da50bce4c540eb4bc3c59d75e6614f6262ab2ca6a0771b1f6a4ae6f47b1e1bb93f4fa148165a47809f6eb9007cacb33b586fad58faf515c2f8b50
SSDEEP 3072:e/1ldcYv3FfUlXrsWD5siV4vr00MgRUxUi15yOrbL8Mbb:e/TP6F4u572vlMgmb
TLSH
T1BC248CA37591E032E0470475525BC77E9EBDFCF816318487BBC41E9A9FB5293DA2A302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

94033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

advapi32

GetUserNameA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

kernel32

MoveFileA FindNextFileA HeapAlloc HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx ProcessIdToSessionId VirtualProtect DuplicateHandle WriteProcessMemory GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError LoadLibraryA OpenThread CreateToolhelp32Snapshot SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA FindClose TerminateProcess Process32Next CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA CreateThread GetVersionExA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe GetEnvironmentVariableA CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile SetEnvironmentVariableW VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapSize DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateFileA GetCurrentProcessId GetLocalTime Sleep Process32First GetTickCount SetFilePointer GetFileType SetHandleCount GetConsoleMode GetModuleHandleW ExitProcess MultiByteToWideChar DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind WideCharToMultiByte GetConsoleCP

kernelbase

DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage

wininet

HttpQueryInfoA InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetQueryOptionA InternetOpenA

ws2_32

htons connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl htonl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket