cobaltstrike | 2041f732970959b337c97712df88b53e9a46443d4d3c3120f6d54c5473d3932d[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
2041f732970959b337c97712df88b53e9a46443d4d3c3120f6d54c5473d3932d.zip
Size 105KB
Sample260930-mpymmsx1az
SHA256 cf6a49312a9faec5cb37b520f5e492bc8f719abd3e1f294013735d4c5e1a9248
MD5 032e4f2f9a9a1f38db77ff1719164b51
SHA1 af60a33cc931637cc3c2048b1281f4811f746ec1
SHA512 5522b005c8ac45e2ef5d601b2f973b888c1340019ea4e62328751f4ce398283a146ad9b5f56f7a4df9f0a39075b16f3db3645302cdf30756651f3120059d02b5
SSDEEP 3072:hD4Hx9KA4lVUM7UOhZ/1ynXEzBXsg4QWaF3vUVbl7ll:hD4HxUuM7fZdk28g1F3EB
TLSH
T1A3B3125B9CA6AE27374D16528756A9BF233022250C25DF74805FF926BEF99889C3B110
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/2041f732970959b337c97712df88b53e9a46443d4d3c3120f6d54c5473d3932d	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2041f732970959b337c97712df88b53e9a46443d4d3c3120f6d54c5473d3932d

File Explorer

2041f732970959b337c97712df88b53e9a46443d4d3c3120f6d54c5473d3932d.zip

.zip 105KB
2041f732970959b337c97712df88b53e9a46443d4d3c3120f6d54c5473d3932d

.dll 210KB

2041f732970959b337c97712df88b53e9a46443d4d3c3120f6d54c5473d3932d.zip

SHA256 cf6a49312a9faec5cb37b520f5e492bc8f719abd3e1f294013735d4c5e1a9248
MD5 032e4f2f9a9a1f38db77ff1719164b51
SHA1 af60a33cc931637cc3c2048b1281f4811f746ec1
SHA512 5522b005c8ac45e2ef5d601b2f973b888c1340019ea4e62328751f4ce398283a146ad9b5f56f7a4df9f0a39075b16f3db3645302cdf30756651f3120059d02b5
SSDEEP 3072:hD4Hx9KA4lVUM7UOhZ/1ynXEzBXsg4QWaF3vUVbl7ll:hD4HxUuM7fZdk28g1F3EB
TLSH
T1A3B3125B9CA6AE27374D16528756A9BF233022250C25DF74805FF926BEF99889C3B110
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

2041f732970959b337c97712df88b53e9a46443d4d3c3120f6d54c5473d3932d

IMPHASH cee2783f5b537863eedf6975484fc19a
SHA256 2041f732970959b337c97712df88b53e9a46443d4d3c3120f6d54c5473d3932d
MD5 472e063b5228a49f58d9f47351915500
SHA1 0f8d88153ce0215ca4968d7f5161d20fcbb90329
SHA512 90135d30a075b64c73444dff923d334dca98cee33202903df44d62f92dd4aa3967caaa2abebd2994b84407dcc5b10991102bf7f4436bc3ac7538ffb97c5004ec
SSDEEP 3072:eqa1ldcYv3FfkUmtlXrsu57V4sW00RgRUxT15merbL8Mbb:eqaTP7mtF4u572NRgmv
TLSH
T111247CA175C1D033D0560474521FC77E9ABDFDF41632A583BBC81A6AAE753A3E72A302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

94033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

advapi32

GetUserNameA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

kernel32

MoveFileA FindNextFileA HeapAlloc HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx ProcessIdToSessionId VirtualProtect DuplicateHandle WriteProcessMemory GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError LoadLibraryA OpenThread CreateToolhelp32Snapshot SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA FindClose TerminateProcess Process32Next CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA CreateThread GetVersionExA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe GetEnvironmentVariableA CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile SetEnvironmentVariableW VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapSize DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateFileA GetCurrentProcessId GetLocalTime Sleep Process32First GetTickCount SetFilePointer GetFileType SetHandleCount GetConsoleMode GetModuleHandleW ExitProcess MultiByteToWideChar DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind WideCharToMultiByte GetConsoleCP

kernelbase

DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage

wininet

HttpQueryInfoA InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetQueryOptionA InternetOpenA

ws2_32

htons connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl htonl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket