cobaltstrike | afbe33901a939037e0414defa5e74fefcb7e47a3694f78af068fe1a74a917ceb[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
afbe33901a939037e0414defa5e74fefcb7e47a3694f78af068fe1a74a917ceb.zip
Size 105KB
Sample260808-mb5h2adn41
SHA256 c566b10967653f8a814b8134599ef614671c18ae1c91c15ff897e20977f35cb7
MD5 573839eb7a207d21c0ca6c34bd316229
SHA1 93d218724bd939cbb1ac9693a3f20d1dfee53754
SHA512 403e48b5d6b0892b17ec6a39555721a256c927d89bf569db29f51f4ef4522f83112c93a9e185b83d0efe1a84cf1567f21423798f7d2e65a7e99a174f2b725eb0
SSDEEP 3072:IQ0vO5pPzHv/Mlfs/rs0bfIYP0SUHWnMqYQVU2Fvl0T:IZ251vECAkIYPIHWn3K+vli
TLSH
T163B312DA4F71A7FDC3CB94583E1B632398DB8ADA7E584239A39F1C40129F16390D3A15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

Attributes

watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/afbe33901a939037e0414defa5e74fefcb7e47a3694f78af068fe1a74a917ceb	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/afbe33901a939037e0414defa5e74fefcb7e47a3694f78af068fe1a74a917ceb

File Explorer

afbe33901a939037e0414defa5e74fefcb7e47a3694f78af068fe1a74a917ceb.zip

.zip 105KB
afbe33901a939037e0414defa5e74fefcb7e47a3694f78af068fe1a74a917ceb

.dll 210KB

afbe33901a939037e0414defa5e74fefcb7e47a3694f78af068fe1a74a917ceb.zip

SHA256 c566b10967653f8a814b8134599ef614671c18ae1c91c15ff897e20977f35cb7
MD5 573839eb7a207d21c0ca6c34bd316229
SHA1 93d218724bd939cbb1ac9693a3f20d1dfee53754
SHA512 403e48b5d6b0892b17ec6a39555721a256c927d89bf569db29f51f4ef4522f83112c93a9e185b83d0efe1a84cf1567f21423798f7d2e65a7e99a174f2b725eb0
SSDEEP 3072:IQ0vO5pPzHv/Mlfs/rs0bfIYP0SUHWnMqYQVU2Fvl0T:IZ251vECAkIYPIHWn3K+vli
TLSH
T163B312DA4F71A7FDC3CB94583E1B632398DB8ADA7E584239A39F1C40129F16390D3A15
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

afbe33901a939037e0414defa5e74fefcb7e47a3694f78af068fe1a74a917ceb

IMPHASH cee2783f5b537863eedf6975484fc19a
SHA256 afbe33901a939037e0414defa5e74fefcb7e47a3694f78af068fe1a74a917ceb
MD5 57aa67c550977ce5a693428d6e3ccd51
SHA1 4364f64a68fdddb096a96aaaedc2e13c98f21d97
SHA512 e7967cb658b79faf85332382ea851ff374557b5bf088300b6a87861bdc7b51cdcb55b37b6df1c199e38e3acb906fc230334327a149ebc08db096c2f95966c683
SSDEEP 3072:ilFxN98EHbpDQVLHYpMqw1rhY3cEGARUN715nXrbL8Mbb:ilFD7eZ4p/w1rK5GAqT
TLSH
T105248DA135C1D032D24B0874521BC77F9ABDFCF41632A457BBC81A56AE75793EA2A303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

94033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

advapi32

GetUserNameA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

kernel32

MoveFileA FindNextFileA HeapAlloc HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx ProcessIdToSessionId VirtualProtect DuplicateHandle WriteProcessMemory GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError LoadLibraryA OpenThread CreateToolhelp32Snapshot SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA FindClose TerminateProcess Process32Next CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA CreateThread GetVersionExA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe GetEnvironmentVariableA CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile SetEnvironmentVariableW VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapSize DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateFileA GetCurrentProcessId GetLocalTime Sleep Process32First GetTickCount SetFilePointer GetFileType SetHandleCount GetConsoleMode GetModuleHandleW ExitProcess MultiByteToWideChar DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind WideCharToMultiByte GetConsoleCP

kernelbase

DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage

wininet

HttpQueryInfoA InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetQueryOptionA InternetOpenA

ws2_32

htons connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl htonl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket