cobaltstrike | d9a00d8dc918939bf98a9082bd7101dfa5398e20041fffddcbb18bcbdafc251c

Sharing

Copy URL Twitter E-mail

General

Target
d9a00d8dc918939bf98a9082bd7101dfa5398e20041fffddcbb18bcbdafc251c
Size 145KB
Sample260924-c2fbqacc63
SHA256 d9a00d8dc918939bf98a9082bd7101dfa5398e20041fffddcbb18bcbdafc251c
MD5 ef5034592abd0bb4aa94622b75ab1489
SHA1 73dffa599ef17f8fbab81a68f241e61c86d1ab31
SHA512 bad3347eb2c4831d1bd0eb748ee5e20d752470827d411ee3023f3ba550c1d4cfa3c5d4a43a3d639a33b30dec2f2ce9389a91c9f1603c6f9106256c85ee0bc145
SSDEEP 384:S9Zrb5YW85hxy4lVX4AYWjgToP6kqwjwPhNdByD215rN:M58784z4ARE06kxKhLByDGN
TLSH
T1A6E3E865E932FA05C78F243E24889C6F859B1E185FE146EFC3908B1D454AAC0577E2EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

http://120.26.240.21:8080/ePEc

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; Touch; ASU2JS)

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9a00d8dc918939bf98a9082bd7101dfa5398e20041fffddcbb18bcbdafc251c

File Explorer

d9a00d8dc918939bf98a9082bd7101dfa5398e20041fffddcbb18bcbdafc251c

.exe 145KB

d9a00d8dc918939bf98a9082bd7101dfa5398e20041fffddcbb18bcbdafc251c

IMPHASH 8116bd57c102166978264eb752928e71
SHA256 d9a00d8dc918939bf98a9082bd7101dfa5398e20041fffddcbb18bcbdafc251c
MD5 ef5034592abd0bb4aa94622b75ab1489
SHA1 73dffa599ef17f8fbab81a68f241e61c86d1ab31
SHA512 bad3347eb2c4831d1bd0eb748ee5e20d752470827d411ee3023f3ba550c1d4cfa3c5d4a43a3d639a33b30dec2f2ce9389a91c9f1603c6f9106256c85ee0bc145
SSDEEP 384:S9Zrb5YW85hxy4lVX4AYWjgToP6kqwjwPhNdByD215rN:M58784z4ARE06kxKhLByDGN
TLSH
T1A6E3E865E932FA05C78F243E24889C6F859B1E185FE146EFC3908B1D454AAC0577E2EF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69667

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\netpr1s0ner\source\repos\test\Debug\test.pdb

kernel32

VirtualAlloc GetCurrentProcess GetProcAddress FreeLibrary VirtualQuery GetProcessHeap HeapFree HeapAlloc GetLastError GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter WideCharToMultiByte MultiByteToWideChar RaiseException IsDebuggerPresent GetCurrentThreadId TerminateProcess

vcruntime140d

__std_type_info_destroy_list __current_exception __current_exception_context memset _except_handler4_common __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_LoadLibraryExW memcpy

ucrtbased

_exit _seh_filter_dll _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit _controlfp_s terminate _wmakepath_s _wsplitpath_s strcpy_s __stdio_common_vsprintf_s exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __setusermatherr _set_app_type _seh_filter_exe _CrtDbgReportW _CrtDbgReport strcat_s __p__commode _set_new_mode _configthreadlocale _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc wcscpy_s _set_fmode

Name

.textbss

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

282B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

265B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rdata2

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

d9a00d8dc918939bf98a9082bd7101dfa5398e20041fffddcbb18bcbdafc251c

kernel32

vcruntime140d

ucrtbased

generic