cobaltstrike | e85c8d9e3373d4ea3a55c8a73302f83d7e2f3209b928381d10908fe44e7a7bf4[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
e85c8d9e3373d4ea3a55c8a73302f83d7e2f3209b928381d10908fe44e7a7bf4.zip
Size 105KB
Sample260930-jghpnsaa37
SHA256 ca20f0d6b01364bb34d48129aa72cb7ac5d678f78b92c7b600c492009947ab4d
MD5 82455882a2e5fbb125f726227ebe1bc8
SHA1 6c5a6d038572ccff2172b2ef5448500c9e462ac0
SHA512 03c547f8bb4d97b5d199ebb9941199cde2595099effc73e559210f30e2ed5813a89e4b235a448299d750fb1e4adcaa06e214c630ce691b6665c72bfc7a09409a
SSDEEP 1536:GwthxppQosBgjFlGi5psqm9BDY34n2KSqAt86nRz563Il5uk3H2pGOws9:xh/W8jFYi5hm7n5DVyz0Zk3WRww
TLSH
T19BB312C24B903D7B91C382D1A20B95C7F0ACE7AD9E72869515DCC02A5EFDD8498DB932
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/e85c8d9e3373d4ea3a55c8a73302f83d7e2f3209b928381d10908fe44e7a7bf4	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e85c8d9e3373d4ea3a55c8a73302f83d7e2f3209b928381d10908fe44e7a7bf4

File Explorer

e85c8d9e3373d4ea3a55c8a73302f83d7e2f3209b928381d10908fe44e7a7bf4.zip

.zip 105KB
e85c8d9e3373d4ea3a55c8a73302f83d7e2f3209b928381d10908fe44e7a7bf4

.dll 210KB

e85c8d9e3373d4ea3a55c8a73302f83d7e2f3209b928381d10908fe44e7a7bf4.zip

SHA256 ca20f0d6b01364bb34d48129aa72cb7ac5d678f78b92c7b600c492009947ab4d
MD5 82455882a2e5fbb125f726227ebe1bc8
SHA1 6c5a6d038572ccff2172b2ef5448500c9e462ac0
SHA512 03c547f8bb4d97b5d199ebb9941199cde2595099effc73e559210f30e2ed5813a89e4b235a448299d750fb1e4adcaa06e214c630ce691b6665c72bfc7a09409a
SSDEEP 1536:GwthxppQosBgjFlGi5psqm9BDY34n2KSqAt86nRz563Il5uk3H2pGOws9:xh/W8jFYi5hm7n5DVyz0Zk3WRww
TLSH
T19BB312C24B903D7B91C382D1A20B95C7F0ACE7AD9E72869515DCC02A5EFDD8498DB932
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

e85c8d9e3373d4ea3a55c8a73302f83d7e2f3209b928381d10908fe44e7a7bf4

IMPHASH cee2783f5b537863eedf6975484fc19a
SHA256 e85c8d9e3373d4ea3a55c8a73302f83d7e2f3209b928381d10908fe44e7a7bf4
MD5 c3a4aca3aa0e745f44a0eedb5647d201
SHA1 c268963e33ea8c413477c46897c42240b9508eae
SHA512 6df2100fe97772f60511b2f19719680eb49c317540a3175cc7233b5733bce7ff06725b5ec3e04d83af6e91319bccca5ff145d9c8f075359ac84becac9f35794c
SSDEEP 3072:eqa1ldcYv3FfkUmtlXrsu57V4sW00RgRUxT15GorbL8Mbb:eqaTP7mtF4u572NRgmR
TLSH
T17D247CA175C1D033D0560474521FC77E9ABDFDF41632A583BBC81A6AAE753A3E72A302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

94033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

advapi32

GetUserNameA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

kernel32

MoveFileA FindNextFileA HeapAlloc HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx ProcessIdToSessionId VirtualProtect DuplicateHandle WriteProcessMemory GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError LoadLibraryA OpenThread CreateToolhelp32Snapshot SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA FindClose TerminateProcess Process32Next CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA CreateThread GetVersionExA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe GetEnvironmentVariableA CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile SetEnvironmentVariableW VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapSize DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateFileA GetCurrentProcessId GetLocalTime Sleep Process32First GetTickCount SetFilePointer GetFileType SetHandleCount GetConsoleMode GetModuleHandleW ExitProcess MultiByteToWideChar DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind WideCharToMultiByte GetConsoleCP

kernelbase

DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage

wininet

HttpQueryInfoA InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetQueryOptionA InternetOpenA

ws2_32

htons connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl htonl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket