cobaltstrike | 58ee40410a8675ca90bbe6976dcee467bffe4846afcad0b087d035aca6b751b4[.]zip

General

Target
58ee40410a8675ca90bbe6976dcee467bffe4846afcad0b087d035aca6b751b4.zip
Size 111KB
Sample260925-tj8c8a113n
SHA256 696b337a2b19ebce857f59efbcabf3b5a2294579cb4daf958ad64156e6eb84e8
MD5 5e4b4aa642c199870c39bfa41cdeefb1
SHA1 d9e923c7f7e3bcabd06a5e448ae700986f9f992e
SHA512 c2a87f938b8271371f3d80e72675480f1c53e65552190cbef3b1b7726e386dac9fd889df489fe441a73d9e8bfb256cedd61cea5058d39948b0e91da3a0aa19f7
SSDEEP 3072:E0LA8A5SvxbWpI+XSHW8nSuy/cTn64Vrzc20XqaSiPWSAA74CxhDZT7:EmAzQJbW6+XS2oSH064VXJ61rPWSAA7F
TLSH
T13AB31287A97A5521C0A663FE70A478534DBEF4FC41A796C8A100B65EEFFF138481B193
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan backdoor cobaltstrike

Malware Config

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/58ee40410a8675ca90bbe6976dcee467bffe4846afcad0b087d035aca6b751b4	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/58ee40410a8675ca90bbe6976dcee467bffe4846afcad0b087d035aca6b751b4

File Explorer

58ee40410a8675ca90bbe6976dcee467bffe4846afcad0b087d035aca6b751b4.zip

.zip 111KB
58ee40410a8675ca90bbe6976dcee467bffe4846afcad0b087d035aca6b751b4

.dll 244KB

58ee40410a8675ca90bbe6976dcee467bffe4846afcad0b087d035aca6b751b4.zip

SHA256 696b337a2b19ebce857f59efbcabf3b5a2294579cb4daf958ad64156e6eb84e8
MD5 5e4b4aa642c199870c39bfa41cdeefb1
SHA1 d9e923c7f7e3bcabd06a5e448ae700986f9f992e
SHA512 c2a87f938b8271371f3d80e72675480f1c53e65552190cbef3b1b7726e386dac9fd889df489fe441a73d9e8bfb256cedd61cea5058d39948b0e91da3a0aa19f7
SSDEEP 3072:E0LA8A5SvxbWpI+XSHW8nSuy/cTn64Vrzc20XqaSiPWSAA74CxhDZT7:EmAzQJbW6+XS2oSH064VXJ61rPWSAA7F
TLSH
T13AB31287A97A5521C0A663FE70A478534DBEF4FC41A796C8A100B65EEFFF138481B193
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

58ee40410a8675ca90bbe6976dcee467bffe4846afcad0b087d035aca6b751b4

IMPHASH 6a6c26505ccc986d1049664aca817a99
SHA256 58ee40410a8675ca90bbe6976dcee467bffe4846afcad0b087d035aca6b751b4
MD5 ec2f659262dbbeb12073e363d8349f23
SHA1 7e5d897de19ea87fe8a65a91ea08053355fad431
SHA512 1bbeca978caad5ac7d18e4d013c788052edec9432bb827ad7fa1d6298d50fbd2c77661a30b557d52cf0e04dad0ea120840ea167f3dd94b5a141ba56511f113be
SSDEEP 3072:OQS+bEEfKQyoy2krvkqg18CrLJocOWT/HpWLO9y/uJViaGMF1YGZjtU25oQ:OZEfAo6rvY18CrtJjHpMO9y/iF1Yqj
TLSH
T1F4348C523593C172E4631179634ACB724FBDFC3427306987BBD84A9A8F262D2DA39307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

5

Entry point

89384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

GetThreadContext ReadProcessMemory CreateProcessA TerminateProcess GetCurrentDirectoryW VirtualProtectEx WriteProcessMemory ResumeThread GetFullPathNameA SystemTimeToTzSpecificLocalTime GetLogicalDrives ExpandEnvironmentStringsA GetFileAttributesA FileTimeToSystemTime FindFirstFileA CopyFileA FindClose MoveFileA FindNextFileA VirtualProtect OpenProcess GetCurrentProcessId Thread32First Thread32Next VirtualAllocEx OpenThread CreateToolhelp32Snapshot CreateThread CreateRemoteThread SetThreadContext MapViewOfFile UnmapViewOfFile CreateFileMappingA SetLastError GetVersionExA CreateFileA PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState GetComputerNameA GetACP GetModuleFileNameA GetOEMCP DeleteProcThreadAttributeList CreateNamedPipeA HeapFree GetProcessHeap InitializeProcThreadAttributeList SetErrorMode UpdateProcThreadAttribute ProcessIdToSessionId DuplicateHandle Process32First Process32Next VirtualQuery ExitProcess ExitThread ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetCurrentDirectoryA CreatePipe GetLocalTime GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe MultiByteToWideChar WriteFile GetTickCount WaitForSingleObject Sleep GetModuleHandleA DebugBreak RaiseException GetModuleFileNameW SetEnvironmentVariableW LoadLibraryA VirtualAlloc GetProcAddress SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA HeapSize IsValidCodePage GetCPInfo GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW VirtualFree HeapAlloc FreeLibrary GetModuleHandleW DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode SetHandleCount GetFileType SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings

advapi32

LookupAccountSidA OpenThreadToken CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx OpenProcessToken GetTokenInformation GetUserNameA CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA AdjustTokenPrivileges ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA

wininet

InternetReadFile InternetConnectA InternetQueryDataAvailable InternetSetOptionA HttpOpenRequestA HttpAddRequestHeadersA InternetSetStatusCallback HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA HttpQueryInfoA

ws2_32

closesocket send gethostname WSAStartup socket gethostbyname ntohl htons htonl connect ntohs recv shutdown WSAGetLastError ioctlsocket accept listen __WSAFDIsSet bind select WSACleanup

Sharing