e8ba6886f46c9e7fe881c478c028a2738d68010721ee63079db0385271dd52ce.zip
- SHA256 bb7fc86a9c0baa96ae9c18dbc5817ab8030d9b5acd3b70f8e7913b97f2a07b08
Password
infected
Behavioral task
behavioral1
Sample
e8ba6886f46c9e7fe881c478c028a2738d68010721ee63079db0385271dd52ce.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
e8ba6886f46c9e7fe881c478c028a2738d68010721ee63079db0385271dd52ce.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target e8ba6886f46c9e7fe881c478c028a2738d68010721ee63079db0385271dd52ce.zip
- Size 114KB
- Sample260825-klmd4aygpc
- SHA256 bb7fc86a9c0baa96ae9c18dbc5817ab8030d9b5acd3b70f8e7913b97f2a07b08
- MD5 1dfb810c2a77a7129c10f2a949c51112
- SHA1 cbe319ca46d153e861e42d7ea15ef756231211a8
- SHA512 b513d13bca1298321234e201c00d8882b350dc2026249e43209c7f4b2936ca92923bac9a958b977d8df2cba2c6df36ade970599f078644f87ab44d12a9287e1f
- SSDEEP 3072:TJTytUwGCVV186ahDq89p5na8SO4JprdWOf2ZQfCD5:V4V1/k5nTSO43EQqt
- TLSH T142B3123BADCC6B5DD5375074EEFA6287AD584D87F8E013312F8B05D48962972202CE87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/e8ba6886f46c9e7fe881c478c028a2738d68010721ee63079db0385271dd52ce
File Explorer
-
e8ba6886f46c9e7fe881c478c028a2738d68010721ee63079db0385271dd52ce.zip.zip 114KB
-
e8ba6886f46c9e7fe881c478c028a2738d68010721ee63079db0385271dd52ce.dll 268KB
e8ba6886f46c9e7fe881c478c028a2738d68010721ee63079db0385271dd52ce
- IMPHASH d6ce0353e0f4b514e2aad1c44f2f82a7
- SHA256 e8ba6886f46c9e7fe881c478c028a2738d68010721ee63079db0385271dd52ce
- MD5 c14c472dcebac2402f15583177625273
- SHA1 7323cc0a3390b8a5f9279a0bb44c5542bacdc8db
- SHA512 71ffb4590112c8a121dd06d09642116f5bef5253bbe8431de1888cf7890e4ba51c454e1b62e741e9f3d143bd29f83df57ab37e5ce7796cf00ead599d4ccde890
- SSDEEP 3072:yPSw+4enHuvtsYoWHD8GzSSvCdIiF4ygnfL954hUwgHDL5W9x:j0nHD8G+gCdIi2fnR54YHDI
- TLSH T1C0448D627181E032D0570834561EC7629EBDFC7026359887FBDD0A56AE767A3EB2A343
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
5
Entry point
95393
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
kernel32
HeapFree
GetProcessHeap
CreateRemoteThread
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
LoadLibraryA
ProcessIdToSessionId
VirtualProtect
DuplicateHandle
InitializeProcThreadAttributeList
WriteProcessMemory
CreateThread
GetThreadContext
SetThreadContext
FreeLibrary
VirtualFree
Thread32First
Thread32Next
SetLastError
OpenThread
CreateToolhelp32Snapshot
GetVersionExA
SuspendThread
ResumeThread
PeekNamedPipe
WaitNamedPipeA
SetNamedPipeHandleState
LocalAlloc
LocalFree
GetComputerNameA
Process32First
TerminateProcess
UpdateProcThreadAttribute
ExitProcess
HeapAlloc
DeleteProcThreadAttributeList
FindNextFileA
MoveFileA
FindClose
CopyFileA
FindFirstFileA
FileTimeToSystemTime
GetFileAttributesA
ExpandEnvironmentStringsA
GetLogicalDrives
SystemTimeToTzSpecificLocalTime
GetFullPathNameA
GetModuleHandleA
CreateNamedPipeA
GetProcAddress
ReadFile
GetCurrentThread
ConnectNamedPipe
GetCurrentProcess
CloseHandle
GetFileTime
GetCurrentDirectoryA
CreatePipe
GetCurrentDirectoryW
GetLastError
GetStartupInfoA
SetCurrentDirectoryA
FlushFileBuffers
DisconnectNamedPipe
MultiByteToWideChar
CreateProcessA
OpenProcess
WriteFile
SetFileTime
WaitForSingleObject
SetEnvironmentVariableW
CreateFileA
GetCurrentProcessId
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
VirtualQuery
GetModuleFileNameW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
HeapSize
IsValidCodePage
GetCPInfo
DebugBreak
RaiseException
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetOEMCP
GetLocalTime
GetACP
Sleep
Process32Next
GetTickCount
GetEnvironmentStrings
FreeEnvironmentStringsA
SetFilePointer
GetFileType
GetModuleHandleW
DeleteFileA
CreateDirectoryA
RemoveDirectoryA
GetCurrentThreadId
GetCommandLineA
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetHandleCount
advapi32
RegEnumValueA
CloseServiceHandle
OpenProcessToken
CreateProcessWithLogonW
DeleteService
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
LogonUserA
CheckTokenMembership
FreeSid
RevertToSelf
AllocateAndInitializeSid
DuplicateTokenEx
LookupAccountSidA
GetTokenInformation
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegEnumKeyA
CreateProcessAsUserA
RegOpenCurrentUser
RegOpenKeyExA
GetUserNameA
AdjustTokenPrivileges
ControlService
QueryServiceStatusEx
ImpersonateNamedPipeClient
ImpersonateLoggedOnUser
LookupPrivilegeValueA
OpenThreadToken
OpenServiceA
OpenSCManagerA
QueryServiceStatus
CreateProcessWithTokenW
StartServiceA
CreateServiceA
wininet
HttpQueryInfoA
InternetQueryDataAvailable
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetCloseHandle
InternetQueryOptionA
InternetConnectA
ws2_32
ntohs
connect
htons
socket
accept
send
gethostname
inet_ntoa
WSAStartup
WSACleanup
gethostbyname
htonl
ntohl
listen
__WSAFDIsSet
bind
recv
shutdown
WSAGetLastError
select
ioctlsocket
inet_addr
closesocket
dnsapi
DnsFree
DnsQuery_A
iphlpapi
GetIfEntry
GetIpAddrTable
secur32
LsaCallAuthenticationPackage
LsaConnectUntrusted
LsaLookupAuthenticationPackage
_ReflectiveLoader@4
Name
.text
Size
148KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=150, version=20413,
count=40, id=132, productName=VS2008 build 21022, version=21022,
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=130, id=131, productName=VS2008 build 21022, version=21022,
count=15, id=123, productName=VS2005 build 50727, version=50727,
count=225, id=1, productName=Unmarked objects,
count=187, id=137, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,