cobaltstrike | ca159dc01226e233e15e3e8c47bfc3ca113764453d58e08ed08edfc27eae3ac5[.]zip

General

Target
ca159dc01226e233e15e3e8c47bfc3ca113764453d58e08ed08edfc27eae3ac5.zip
Size 113KB
Sample261002-e99xeaysfx
SHA256 fd0d96773cfe8358d0afb8aae8cded5c4482961a1ae37833312206ce8af12391
MD5 7b1d27203fc18056992563895f1669f5
SHA1 b0fdde414619fcae2f91a40bea2c03a03281f1dc
SHA512 ad71b21ad1e9858cc15f5d1482f3f2845631f04733717d62dc739109e72c3040882739531192cb45df5035be23c530c253600a167542ebc7b4b2549a30576e76
SSDEEP 3072:awtGYolnhUXVsun/NKn+vjV1vgYi1A05R:awEvnhIVsW4+vjV141h5R
TLSH
T1C3B3122C179D125DA6FC8A41808083FB0D5B9B779057AE12DEC769AF47AD3936E90C2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan backdoor cobaltstrike

Malware Config

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/ca159dc01226e233e15e3e8c47bfc3ca113764453d58e08ed08edfc27eae3ac5	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ca159dc01226e233e15e3e8c47bfc3ca113764453d58e08ed08edfc27eae3ac5

File Explorer

ca159dc01226e233e15e3e8c47bfc3ca113764453d58e08ed08edfc27eae3ac5.zip

.zip 113KB
ca159dc01226e233e15e3e8c47bfc3ca113764453d58e08ed08edfc27eae3ac5

.dll 248KB

ca159dc01226e233e15e3e8c47bfc3ca113764453d58e08ed08edfc27eae3ac5.zip

SHA256 fd0d96773cfe8358d0afb8aae8cded5c4482961a1ae37833312206ce8af12391
MD5 7b1d27203fc18056992563895f1669f5
SHA1 b0fdde414619fcae2f91a40bea2c03a03281f1dc
SHA512 ad71b21ad1e9858cc15f5d1482f3f2845631f04733717d62dc739109e72c3040882739531192cb45df5035be23c530c253600a167542ebc7b4b2549a30576e76
SSDEEP 3072:awtGYolnhUXVsun/NKn+vjV1vgYi1A05R:awEvnhIVsW4+vjV141h5R
TLSH
T1C3B3122C179D125DA6FC8A41808083FB0D5B9B779057AE12DEC769AF47AD3936E90C2C
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

ca159dc01226e233e15e3e8c47bfc3ca113764453d58e08ed08edfc27eae3ac5

IMPHASH cef0a8b67e0adea9dbc532568c79bb24
SHA256 ca159dc01226e233e15e3e8c47bfc3ca113764453d58e08ed08edfc27eae3ac5
MD5 cb062fd72cf3ec01497d3d0f8dd28318
SHA1 e96d836af9895239f8351936f04530e003972511
SHA512 fd37535fefed4af5bdeeade67322d1a3d1b021a5d528f7864b74a2f98538a73eeab274396f02dfc83d9e339a8b5bf2514f28a7c4be87078bf5cf3e2509fca17f
SSDEEP 3072:04KKqRChfPXUF89x8CSFH7T4cydkliRdf6xTGbvZjdUzY5O:04jfPXw8z8C6f4cydklisTGbRj
TLSH
T1A4448D1135C1C436D45B0879631AC7768FBDBC341671A9C7BB885AA94F3229FEB2A307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

5

Entry point

93381

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

GetThreadContext ReadProcessMemory CreateProcessA TerminateProcess GetCurrentDirectoryW VirtualProtectEx WriteProcessMemory ResumeThread GetFullPathNameA SystemTimeToTzSpecificLocalTime GetLogicalDrives ExpandEnvironmentStringsA GetFileAttributesA FileTimeToSystemTime FindFirstFileA CopyFileA FindClose MoveFileA FindNextFileA OpenProcess GetCurrentProcessId Thread32First Thread32Next VirtualAllocEx OpenThread CreateToolhelp32Snapshot CreateThread CreateRemoteThread SetThreadContext MapViewOfFile UnmapViewOfFile CreateFileMappingA VirtualProtect SetLastError GetVersionExA CreateFileA PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState GetComputerNameA GetACP GetModuleFileNameA GetOEMCP DeleteProcThreadAttributeList HeapAlloc CreateNamedPipeA GetProcessHeap InitializeProcThreadAttributeList SetErrorMode UpdateProcThreadAttribute ProcessIdToSessionId DuplicateHandle Process32First Process32Next VirtualQuery ExitProcess ExitThread ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetCurrentDirectoryA CreatePipe GetLocalTime GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe MultiByteToWideChar WriteFile GetTickCount WaitForSingleObject Sleep GetModuleHandleA DebugBreak RaiseException SetEnvironmentVariableW GetModuleFileNameW LoadLibraryA VirtualAlloc GetProcAddress SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA HeapSize IsValidCodePage GetCPInfo QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetFilePointer VirtualFree HeapFree FreeLibrary GetModuleHandleW DeleteFileA CreateDirectoryA RemoveDirectoryA GetSystemTimeAsFileTime HeapReAlloc GetCurrentThreadId GetCommandLineA HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode SetHandleCount GetFileType

advapi32

LookupAccountSidA OpenThreadToken CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx OpenProcessToken GetTokenInformation GetUserNameA CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA AdjustTokenPrivileges ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA

wininet

InternetSetOptionA InternetConnectA InternetQueryDataAvailable InternetReadFile HttpOpenRequestA HttpAddRequestHeadersA InternetSetStatusCallback HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA HttpQueryInfoA

ws2_32

gethostbyname send WSAIoctl WSAStartup WSACleanup socket WSASocketA ntohl htons htonl connect ntohs recv shutdown WSAGetLastError ioctlsocket accept listen __WSAFDIsSet bind select closesocket

Sharing