cobaltstrike | 021ca2a247841055f26ec03a5e4ce906522c67b94a748c0f040fe9a7037dfc7c[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
021ca2a247841055f26ec03a5e4ce906522c67b94a748c0f040fe9a7037dfc7c.zip
Size 181KB
Sample260816-tkglws11gx
SHA256 334fc9ac5679424963e8fa3a585f2994d2a47af8c37fc5b1d6f4395d080385eb
MD5 cf102fb7527a2fc84c3faf0fcebc1a3c
SHA1 85e59ae9c78f0d478600f72316f2b00c9f39f072
SHA512 540d2ed89eccb42773411b35bb7a7ce8e9c8e118fbfe3f0c735c974c6b9667e22e82f893d685146998dd239560cd56b7758384138c72156c597d36cf6bbec7c9
SSDEEP 3072:6MQP83vDCIc21bF5yTK8n7W0WRCJbjXGPpZWeJcIl0395+uW+nmivOQQfhyZk2pa:xL3vDCm1bSX7WX4bj2rWVsuW+VOhhyZI
TLSH
T1DB042238F85A5B5B712B79CD3A24E124008AD9EEE78CD9CD241EE2992C1971273F9F41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/021ca2a247841055f26ec03a5e4ce906522c67b94a748c0f040fe9a7037dfc7c	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/021ca2a247841055f26ec03a5e4ce906522c67b94a748c0f040fe9a7037dfc7c

File Explorer

021ca2a247841055f26ec03a5e4ce906522c67b94a748c0f040fe9a7037dfc7c.zip

.zip 181KB
021ca2a247841055f26ec03a5e4ce906522c67b94a748c0f040fe9a7037dfc7c

.dll 299KB

021ca2a247841055f26ec03a5e4ce906522c67b94a748c0f040fe9a7037dfc7c.zip

SHA256 334fc9ac5679424963e8fa3a585f2994d2a47af8c37fc5b1d6f4395d080385eb
MD5 cf102fb7527a2fc84c3faf0fcebc1a3c
SHA1 85e59ae9c78f0d478600f72316f2b00c9f39f072
SHA512 540d2ed89eccb42773411b35bb7a7ce8e9c8e118fbfe3f0c735c974c6b9667e22e82f893d685146998dd239560cd56b7758384138c72156c597d36cf6bbec7c9
SSDEEP 3072:6MQP83vDCIc21bF5yTK8n7W0WRCJbjXGPpZWeJcIl0395+uW+nmivOQQfhyZk2pa:xL3vDCm1bSX7WX4bj2rWVsuW+VOhhyZI
TLSH
T1DB042238F85A5B5B712B79CD3A24E124008AD9EEE78CD9CD241EE2992C1971273F9F41
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

021ca2a247841055f26ec03a5e4ce906522c67b94a748c0f040fe9a7037dfc7c

IMPHASH f2e0b7b9a08bd8dcaf133d9278ecdb47
SHA256 021ca2a247841055f26ec03a5e4ce906522c67b94a748c0f040fe9a7037dfc7c
MD5 350216629928870b9e2739f4c8967786
SHA1 d53fa9b6b6c369923c4c4e96beb4c489cbb4a4cf
SHA512 353192625227fefde69cef7a3761a4bceb333d1da7c42e62cf9b22fb894422a93d77dafe9d625d8d50b120c1f87d7e673ad906353839f087d0aa9192518d272e
SSDEEP 3072:Pjh9N4a1j712h9Td2+1lxvTeZna8xUhUbT15adzdx/DIWHhcaL/aWAOxmjeJKRa9:PjdFKdoSxvixTxUAqdxbBhcU5xPXo6
TLSH
T1C754CFA175C4E037D0570074625BC77E5EB9FDF412B19583BF841AAA9E713A3EB2A203
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

94033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

MoveFileA FindNextFileA DeleteProcThreadAttributeList HeapAlloc UpdateProcThreadAttribute HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx ProcessIdToSessionId VirtualProtect DuplicateHandle InitializeProcThreadAttributeList WriteProcessMemory GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError LoadLibraryA OpenThread CreateToolhelp32Snapshot SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA FindClose TerminateProcess Process32Next CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA CreateThread GetVersionExA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe GetEnvironmentVariableA CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile SetEnvironmentVariableW VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapSize DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateFileA GetCurrentProcessId GetLocalTime Sleep Process32First GetTickCount SetFilePointer GetFileType SetHandleCount GetConsoleMode GetModuleHandleW ExitProcess MultiByteToWideChar DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind WideCharToMultiByte GetConsoleCP

advapi32

GetUserNameA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

wininet

HttpQueryInfoA InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetQueryOptionA InternetOpenA

ws2_32

ntohs connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl ntohl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket inet_addr closesocket

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage