cobaltstrike | fb2ccf148e2b3aa49d80dd1f318c116d1c4518c0c003f7d3d4e2dd54bbab09c5[.]zip

General

Target
fb2ccf148e2b3aa49d80dd1f318c116d1c4518c0c003f7d3d4e2dd54bbab09c5.zip
Size 112KB
Sample260922-2ldwdszzbs
SHA256 3ff68510623236b899f59b9dae3befb14dcd64dc32017cd99641ad58cebb6b4f
MD5 b59656b0c0667bff718126431ea6f190
SHA1 d529d0c81455ff32d713a67c52f4b455991b2f9e
SHA512 2ab27011bfad726508a19754cb49d935e8bbb33ab35eae7398309ded8431a216c58bcac76a15961cd23a5db55ec8910f016bcc53dd274f4031ab88d63115068f
SSDEEP 3072:HQu6d4ir3os9PX+9oJYF5Zut86FrfCtKtO+QV1:HN6d4i39PX+9ocorfsKtO+c1
TLSH
T1EBB31304182E7DF67EF4676B8561CF71AA3B016E8570FC5304E87B33452622A96E9EC3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan backdoor cobaltstrike

Malware Config

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/fb2ccf148e2b3aa49d80dd1f318c116d1c4518c0c003f7d3d4e2dd54bbab09c5	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fb2ccf148e2b3aa49d80dd1f318c116d1c4518c0c003f7d3d4e2dd54bbab09c5

File Explorer

fb2ccf148e2b3aa49d80dd1f318c116d1c4518c0c003f7d3d4e2dd54bbab09c5.zip

.zip 112KB
fb2ccf148e2b3aa49d80dd1f318c116d1c4518c0c003f7d3d4e2dd54bbab09c5

.dll 248KB

fb2ccf148e2b3aa49d80dd1f318c116d1c4518c0c003f7d3d4e2dd54bbab09c5.zip

SHA256 3ff68510623236b899f59b9dae3befb14dcd64dc32017cd99641ad58cebb6b4f
MD5 b59656b0c0667bff718126431ea6f190
SHA1 d529d0c81455ff32d713a67c52f4b455991b2f9e
SHA512 2ab27011bfad726508a19754cb49d935e8bbb33ab35eae7398309ded8431a216c58bcac76a15961cd23a5db55ec8910f016bcc53dd274f4031ab88d63115068f
SSDEEP 3072:HQu6d4ir3os9PX+9oJYF5Zut86FrfCtKtO+QV1:HN6d4i39PX+9ocorfsKtO+c1
TLSH
T1EBB31304182E7DF67EF4676B8561CF71AA3B016E8570FC5304E87B33452622A96E9EC3
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

fb2ccf148e2b3aa49d80dd1f318c116d1c4518c0c003f7d3d4e2dd54bbab09c5

IMPHASH a4a13f49eed906223a6a04bbd4affb28
SHA256 fb2ccf148e2b3aa49d80dd1f318c116d1c4518c0c003f7d3d4e2dd54bbab09c5
MD5 05453fba12f5a078f4217c1483a63a2c
SHA1 2e07d3ac9ba8923821e3f19bc02c114e1da51d35
SHA512 01438a41c72364b37af792ac56527de6654e14f75144ecd7ac7272f9a4cba4fae86443bb675ff08efc57e1adb622e9030972dc4c3bbe1b7565bb6062f03cd7d5
SSDEEP 3072:mBPr+RJXugk9ne4Pp8CITzdTW6/TGnNXlufrFVVkh6DGeNjdUN5+cj:mBgXuR9lx8Cw5Tx/TqNXlufrFnnDGmj
TLSH
T1BD448C223581C077D0960179A35ACB764EBDFC341631A9D7BBC85AA68F31297E73A307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

5

Entry point

90746

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

GetThreadContext ReadProcessMemory CreateProcessA TerminateProcess GetCurrentDirectoryW VirtualProtectEx WriteProcessMemory ResumeThread GetFullPathNameA SystemTimeToTzSpecificLocalTime GetLogicalDrives ExpandEnvironmentStringsA GetFileAttributesA FileTimeToSystemTime FindFirstFileA CopyFileA FindClose MoveFileA FindNextFileA VirtualProtect OpenProcess GetCurrentProcessId Thread32First Thread32Next VirtualAllocEx OpenThread CreateToolhelp32Snapshot CreateThread CreateRemoteThread SetThreadContext MapViewOfFile UnmapViewOfFile CreateFileMappingA SetLastError GetVersionExA CreateFileA PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState GetComputerNameA GetACP GetModuleFileNameA GetOEMCP DeleteProcThreadAttributeList HeapAlloc CreateNamedPipeA GetProcessHeap InitializeProcThreadAttributeList SetErrorMode UpdateProcThreadAttribute ProcessIdToSessionId DuplicateHandle Process32First Process32Next VirtualQuery ExitProcess ExitThread ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetCurrentDirectoryA CreatePipe GetLocalTime GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe MultiByteToWideChar WriteFile GetTickCount WaitForSingleObject Sleep GetModuleHandleA DebugBreak RaiseException SetEnvironmentVariableW GetModuleFileNameW LoadLibraryA VirtualAlloc GetProcAddress SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA HeapSize IsValidCodePage GetCPInfo QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetFilePointer VirtualFree HeapFree FreeLibrary GetModuleHandleW DeleteFileA CreateDirectoryA RemoveDirectoryA GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode SetHandleCount GetFileType

advapi32

LookupAccountSidA OpenThreadToken CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx OpenProcessToken GetTokenInformation GetUserNameA CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA AdjustTokenPrivileges ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA

wininet

InternetSetOptionA InternetConnectA InternetQueryDataAvailable InternetReadFile HttpOpenRequestA HttpAddRequestHeadersA InternetSetStatusCallback HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA HttpQueryInfoA

ws2_32

gethostbyname send WSAIoctl WSAStartup WSACleanup socket WSASocketA ntohl htons htonl connect ntohs recv shutdown WSAGetLastError ioctlsocket accept listen __WSAFDIsSet bind select closesocket

Sharing