cobaltstrike | 7833be9806f9e87e5359fb7a093b240f79f323c1fff422d5d671ca04b5b6eaf7[.]zip

General

Target
7833be9806f9e87e5359fb7a093b240f79f323c1fff422d5d671ca04b5b6eaf7.zip
Size 111KB
Sample260913-lepfjsfk2v
SHA256 5d400d250d7b3bef3e24a0770544b9d890c6d8c827d56ebeebfa13ff5d7d6d4c
MD5 d89465327a9bdd3a7cfdfc62d5d6f94d
SHA1 79ee6b0cc919bf3f3003690b294372769083ea2c
SHA512 d8cc7748ff595a244e34d9be70dff7c26ff36b9ea6a0c99cfbb50932c70ffb812f782e7b73e8eb88febdd29fa27426348aee30ec6dd06d3d2ac6b8c61b12ac83
SSDEEP 3072:sqw3rRizEtavIWAFa9i3g8WB/bUmPpvjPfgTSTE0gtTu:7w3rRizEt1WxidgNvjH2STngTu
TLSH
T1FDB312032E672BB7CF6DAEB6320E6D3650D56CA1356F34B70B93282F6247C51046593E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan backdoor cobaltstrike

Malware Config

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/7833be9806f9e87e5359fb7a093b240f79f323c1fff422d5d671ca04b5b6eaf7	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/7833be9806f9e87e5359fb7a093b240f79f323c1fff422d5d671ca04b5b6eaf7

File Explorer

7833be9806f9e87e5359fb7a093b240f79f323c1fff422d5d671ca04b5b6eaf7.zip

.zip 111KB
7833be9806f9e87e5359fb7a093b240f79f323c1fff422d5d671ca04b5b6eaf7

.dll 244KB

7833be9806f9e87e5359fb7a093b240f79f323c1fff422d5d671ca04b5b6eaf7.zip

SHA256 5d400d250d7b3bef3e24a0770544b9d890c6d8c827d56ebeebfa13ff5d7d6d4c
MD5 d89465327a9bdd3a7cfdfc62d5d6f94d
SHA1 79ee6b0cc919bf3f3003690b294372769083ea2c
SHA512 d8cc7748ff595a244e34d9be70dff7c26ff36b9ea6a0c99cfbb50932c70ffb812f782e7b73e8eb88febdd29fa27426348aee30ec6dd06d3d2ac6b8c61b12ac83
SSDEEP 3072:sqw3rRizEtavIWAFa9i3g8WB/bUmPpvjPfgTSTE0gtTu:7w3rRizEt1WxidgNvjH2STngTu
TLSH
T1FDB312032E672BB7CF6DAEB6320E6D3650D56CA1356F34B70B93282F6247C51046593E
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

7833be9806f9e87e5359fb7a093b240f79f323c1fff422d5d671ca04b5b6eaf7

IMPHASH 6a6c26505ccc986d1049664aca817a99
SHA256 7833be9806f9e87e5359fb7a093b240f79f323c1fff422d5d671ca04b5b6eaf7
MD5 9d96c8b367d685b1c09843e86254a9f7
SHA1 ac689c7ef73dc9ed19d1e9d32086f65f26269580
SHA512 cbe07694fcc2fd2b2e83f2f9f3a829d0d0f2186eb8e974728b1199991270003bfbdf9e0516f511152e42584e913c168baefd6df9416acb4a88903a37333ff7f5
SSDEEP 3072:4VbVnDCEf39vsQcQUje8CzRaGyliIWKtrSaBFpKKyTcZNz9jdU15yj:4r2EftvyQee8CVIrWiuaBPpZNpj
TLSH
T116348C217581C032D0660079534FD7724FBDFC741671A897BB995AAA9F322A3EB3A307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

5

Entry point

89384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

GetThreadContext ReadProcessMemory CreateProcessA TerminateProcess GetCurrentDirectoryW VirtualProtectEx WriteProcessMemory ResumeThread GetFullPathNameA SystemTimeToTzSpecificLocalTime GetLogicalDrives ExpandEnvironmentStringsA GetFileAttributesA FileTimeToSystemTime FindFirstFileA CopyFileA FindClose MoveFileA FindNextFileA VirtualProtect OpenProcess GetCurrentProcessId Thread32First Thread32Next VirtualAllocEx OpenThread CreateToolhelp32Snapshot CreateThread CreateRemoteThread SetThreadContext MapViewOfFile UnmapViewOfFile CreateFileMappingA SetLastError GetVersionExA CreateFileA PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState GetComputerNameA GetACP GetModuleFileNameA GetOEMCP DeleteProcThreadAttributeList CreateNamedPipeA HeapFree GetProcessHeap InitializeProcThreadAttributeList SetErrorMode UpdateProcThreadAttribute ProcessIdToSessionId DuplicateHandle Process32First Process32Next VirtualQuery ExitProcess ExitThread ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetCurrentDirectoryA CreatePipe GetLocalTime GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe MultiByteToWideChar WriteFile GetTickCount WaitForSingleObject Sleep GetModuleHandleA DebugBreak RaiseException GetModuleFileNameW SetEnvironmentVariableW LoadLibraryA VirtualAlloc GetProcAddress SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA HeapSize IsValidCodePage GetCPInfo GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW VirtualFree HeapAlloc FreeLibrary GetModuleHandleW DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode SetHandleCount GetFileType SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings

advapi32

LookupAccountSidA OpenThreadToken CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx OpenProcessToken GetTokenInformation GetUserNameA CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA AdjustTokenPrivileges ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA

wininet

InternetReadFile InternetConnectA InternetQueryDataAvailable InternetSetOptionA HttpOpenRequestA HttpAddRequestHeadersA InternetSetStatusCallback HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA HttpQueryInfoA

ws2_32

closesocket send gethostname WSAStartup socket gethostbyname ntohl htons htonl connect ntohs recv shutdown WSAGetLastError ioctlsocket accept listen __WSAFDIsSet bind select WSACleanup

Sharing