cobaltstrike | b17da1d51b1f483729997a9c3ed61daecc6349b54262a5f954c7f518f5ed59ae

Sharing

Copy URL Twitter E-mail

General

Target
b17da1d51b1f483729997a9c3ed61daecc6349b54262a5f954c7f518f5ed59ae
Size 5.6MB
Sample260916-1es63aee73
SHA256 b17da1d51b1f483729997a9c3ed61daecc6349b54262a5f954c7f518f5ed59ae
MD5 330685376fdce58c9a3768effe457559
SHA1 7a2773ae9504ac414eed46c4cda8892cb351ebb8
SHA512 eef7879df03086ce0ca01b92ebe5e8e938f2e8adbfffe97cff5cf795207046c7e6243943e9069ef2f7b6edccbd861e8452ca9c8beb0baaed2f21918422036da8
SSDEEP 98304:MzhVkEZiJELAsVuqxSTw0DG7ez7mspM75hn3kh1k/ZyITmY8NPq3te0KMo:MIJEfxSTrqGasuH3kTk/dK096
TLSH
T14D561265E933FE08C75B243924449C5FC5E72E185DE1872EC3508B2D4A5BAC0A76F2BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

pyinstaller trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

http://39.104.77.83:8090/wHRL

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.1)

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b17da1d51b1f483729997a9c3ed61daecc6349b54262a5f954c7f518f5ed59ae

File Explorer

b17da1d51b1f483729997a9c3ed61daecc6349b54262a5f954c7f518f5ed59ae

.exe 5.6MB
pyload11.pyc

2KB

b17da1d51b1f483729997a9c3ed61daecc6349b54262a5f954c7f518f5ed59ae

IMPHASH b0d2bcfaf69e32f6189b93d5e3f439ad
SHA256 b17da1d51b1f483729997a9c3ed61daecc6349b54262a5f954c7f518f5ed59ae
MD5 330685376fdce58c9a3768effe457559
SHA1 7a2773ae9504ac414eed46c4cda8892cb351ebb8
SHA512 eef7879df03086ce0ca01b92ebe5e8e938f2e8adbfffe97cff5cf795207046c7e6243943e9069ef2f7b6edccbd861e8452ca9c8beb0baaed2f21918422036da8
SSDEEP 98304:MzhVkEZiJELAsVuqxSTw0DG7ez7mspM75hn3kh1k/ZyITmY8NPq3te0KMo:MIJEfxSTrqGasuH3kTk/dK096
TLSH
T14D561265E933FE08C75B243924449C5FC5E72E185DE1872EC3508B2D4A5BAC0A76F2BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxW MessageBoxA

kernel32

GetModuleFileNameW GetProcAddress GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW GetTempPathW WaitForSingleObject Sleep SetDllDirectoryW CreateProcessW GetStartupInfoW LoadLibraryExW CloseHandle GetCurrentProcess LocalFree FormatMessageW LoadLibraryA MultiByteToWideChar WideCharToMultiByte GetLastError HeapReAlloc SetEndOfFile GetExitCodeProcess GetCommandLineA HeapSize GetTimeZoneInformation RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary RaiseException ReadFile CreateFileW GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFullPathNameW RemoveDirectoryW FindClose FindFirstFileExW FindNextFileW SetStdHandle SetConsoleCtrlHandler DeleteFileW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleCP CompareStringW LCMapStringW GetCurrentDirectoryW FlushFileBuffers SetEnvironmentVariableA GetFileAttributesExW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW GetProcessHeap WriteConsoleW

advapi32

ConvertSidToStringSidW GetTokenInformation OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW

ws2_32

ntohl

Name

.text

Size

129KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

172B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rdata2

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

b17da1d51b1f483729997a9c3ed61daecc6349b54262a5f954c7f518f5ed59ae

user32

kernel32

advapi32

ws2_32

generic

pyload11.pyc