cobaltstrike | 47925224b48d157c9d81415caf6825244fae2af14f51fe4d3270e2a158709751[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
47925224b48d157c9d81415caf6825244fae2af14f51fe4d3270e2a158709751.zip
Size 105KB
Sample260808-j68mdsshpb
SHA256 3e0d52e4a5ebe9d4288abce9871c9895c74cd25cf2092a81c9715a753a14b22e
MD5 d8c33096a8c64263839ea2410a4e4e18
SHA1 81f510c400a01d039a5b1295200d2e851f51a03e
SHA512 0e7d1bf73496086f4243c10d027e42eb06268572411cdeb0bea0e3674f60c0306b4aab2c7bd281ff5633dcc94ff1b497043cfa491b33f5a1ba4a638408dc429d
SSDEEP 3072:kAwVPO87jSnvIy0LOc66CG4013fTlf8ZCQJRPN:yRh7jcZqOx7013Jf8ZCWf
TLSH
T180B3029E2773F4A7FDF791459D8E8CAF242528EE333896030678054E685DB226CD3E94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

Attributes

watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/47925224b48d157c9d81415caf6825244fae2af14f51fe4d3270e2a158709751	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/47925224b48d157c9d81415caf6825244fae2af14f51fe4d3270e2a158709751

File Explorer

47925224b48d157c9d81415caf6825244fae2af14f51fe4d3270e2a158709751.zip

.zip 105KB
47925224b48d157c9d81415caf6825244fae2af14f51fe4d3270e2a158709751

.dll 210KB

47925224b48d157c9d81415caf6825244fae2af14f51fe4d3270e2a158709751.zip

SHA256 3e0d52e4a5ebe9d4288abce9871c9895c74cd25cf2092a81c9715a753a14b22e
MD5 d8c33096a8c64263839ea2410a4e4e18
SHA1 81f510c400a01d039a5b1295200d2e851f51a03e
SHA512 0e7d1bf73496086f4243c10d027e42eb06268572411cdeb0bea0e3674f60c0306b4aab2c7bd281ff5633dcc94ff1b497043cfa491b33f5a1ba4a638408dc429d
SSDEEP 3072:kAwVPO87jSnvIy0LOc66CG4013fTlf8ZCQJRPN:yRh7jcZqOx7013Jf8ZCWf
TLSH
T180B3029E2773F4A7FDF791459D8E8CAF242528EE333896030678054E685DB226CD3E94
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

47925224b48d157c9d81415caf6825244fae2af14f51fe4d3270e2a158709751

IMPHASH cee2783f5b537863eedf6975484fc19a
SHA256 47925224b48d157c9d81415caf6825244fae2af14f51fe4d3270e2a158709751
MD5 a99b5665664fbd93b47f391c396aa369
SHA1 dd8b074291ce73413f78bbc9899924b3e484acc2
SHA512 a8423ddd6d000c1ae3c3349aefbebeceeb7b5c9e0e6aecfa04ab23fb770efc5654703a1b3f441692d7d26d4772cf0af708875c7d981244b62ed4610683bd2c17
SSDEEP 3072:yi6ht9c0AQQ8/5zglnb3DMSjFLx4n8EvjgRU9NN15qHurbL8Mbb:yi6DAxIupYiFL6pbg+Nig
TLSH
T1F2248CA575C2D036E0472474521AC77E9BBDFCF01631D493BBC81A5AAF75293EB2A302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

94033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

advapi32

GetUserNameA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

kernel32

MoveFileA FindNextFileA HeapAlloc HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx ProcessIdToSessionId VirtualProtect DuplicateHandle WriteProcessMemory GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError LoadLibraryA OpenThread CreateToolhelp32Snapshot SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA FindClose TerminateProcess Process32Next CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA CreateThread GetVersionExA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe GetEnvironmentVariableA CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile SetEnvironmentVariableW VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapSize DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateFileA GetCurrentProcessId GetLocalTime Sleep Process32First GetTickCount SetFilePointer GetFileType SetHandleCount GetConsoleMode GetModuleHandleW ExitProcess MultiByteToWideChar DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind WideCharToMultiByte GetConsoleCP

kernelbase

DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage

wininet

HttpQueryInfoA InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetQueryOptionA InternetOpenA

ws2_32

htons connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl htonl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket