cobaltstrike | cd7f006aabf8493a073bae04663e69186dadad1200dc3a2d3fbc600e3cf97cf3[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
cd7f006aabf8493a073bae04663e69186dadad1200dc3a2d3fbc600e3cf97cf3.zip
Size 105KB
Sample260801-jbfywsfe34
SHA256 49cc0eadce66c10f7152544a4a2cbce200846e9f8226839e0b8c1a1224fb65c2
MD5 11dbcbcf5811ee9175ca446a05dca08d
SHA1 adc01f66226f1b655da111e2c4caa3b39cbf3044
SHA512 146ac0db8235748df9d51927fea3e6c35eb8c7ef73e5efb964e2b5d14de50dbc2a42e2433cc89cf5fab4d06b46b77c04d44c5a3f92b4b45eaf9e705f49c6974f
SSDEEP 3072:uNlhh7BJMRNw1zXZ2n7Rw+UDU7TX76nGDF83wr:ShlQN+u1wrUvX+nGDFGwr
TLSH
T1AEB3129D7B4D502BC47105B8D72DC69650FC8C5012E77A1EB7630A2C87BE8661F9AF42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

Attributes

watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/cd7f006aabf8493a073bae04663e69186dadad1200dc3a2d3fbc600e3cf97cf3	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cd7f006aabf8493a073bae04663e69186dadad1200dc3a2d3fbc600e3cf97cf3

File Explorer

cd7f006aabf8493a073bae04663e69186dadad1200dc3a2d3fbc600e3cf97cf3.zip

.zip 105KB
cd7f006aabf8493a073bae04663e69186dadad1200dc3a2d3fbc600e3cf97cf3

.dll 210KB

cd7f006aabf8493a073bae04663e69186dadad1200dc3a2d3fbc600e3cf97cf3.zip

SHA256 49cc0eadce66c10f7152544a4a2cbce200846e9f8226839e0b8c1a1224fb65c2
MD5 11dbcbcf5811ee9175ca446a05dca08d
SHA1 adc01f66226f1b655da111e2c4caa3b39cbf3044
SHA512 146ac0db8235748df9d51927fea3e6c35eb8c7ef73e5efb964e2b5d14de50dbc2a42e2433cc89cf5fab4d06b46b77c04d44c5a3f92b4b45eaf9e705f49c6974f
SSDEEP 3072:uNlhh7BJMRNw1zXZ2n7Rw+UDU7TX76nGDF83wr:ShlQN+u1wrUvX+nGDFGwr
TLSH
T1AEB3129D7B4D502BC47105B8D72DC69650FC8C5012E77A1EB7630A2C87BE8661F9AF42
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

cd7f006aabf8493a073bae04663e69186dadad1200dc3a2d3fbc600e3cf97cf3

IMPHASH cee2783f5b537863eedf6975484fc19a
SHA256 cd7f006aabf8493a073bae04663e69186dadad1200dc3a2d3fbc600e3cf97cf3
MD5 f1b47b8ef98978a20efacb284cc3564d
SHA1 e7c826b018b9ef335d5ea4548e1eaf718e9285d7
SHA512 858f8bd0fd7847575a70786f522c19a6567ee015d0382d29f43de7be93110a334979f8d54c6403935b1e0dedfe04284f4f9e2e62a113457bcc36ce245f2544ea
SSDEEP 3072:zb0m0h3heZB/GrMSZHfOED51PQrKJYkI+tqgNUuX150XrbL8Mbb:zbicSZFmq3IrT6Ig1m
TLSH
T1C8249DA27684D032D0470474529BC77F9ABDFCF416319487BBD41E6A9F727A3E62A302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

94033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

advapi32

GetUserNameA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

kernel32

MoveFileA FindNextFileA HeapAlloc HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx ProcessIdToSessionId VirtualProtect DuplicateHandle WriteProcessMemory GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError LoadLibraryA OpenThread CreateToolhelp32Snapshot SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA FindClose TerminateProcess Process32Next CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA CreateThread GetVersionExA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe GetEnvironmentVariableA CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile SetEnvironmentVariableW VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapSize DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateFileA GetCurrentProcessId GetLocalTime Sleep Process32First GetTickCount SetFilePointer GetFileType SetHandleCount GetConsoleMode GetModuleHandleW ExitProcess MultiByteToWideChar DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind WideCharToMultiByte GetConsoleCP

kernelbase

DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage

wininet

HttpQueryInfoA InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetQueryOptionA InternetOpenA

ws2_32

htons connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl htonl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket