cobaltstrike | 74c27e7099f784c0a51c15eada7603b12fb0306cfac88555aea6c2d64bf8f315[.]zip

General

Target
74c27e7099f784c0a51c15eada7603b12fb0306cfac88555aea6c2d64bf8f315.zip
Size 111KB
Sample261003-2elyesybmd
SHA256 0fe0a5de490f0fca980fe0188eeffe6c850f816ea4236f59ce4a9a342688750e
MD5 68b77e612f5ad57e71ffb4d075d0a3f6
SHA1 028e60758ed3db63ba1cc86d476fc0800eb54387
SHA512 d359c23d059d66af1ad9437a862734b792f9b67a3e7258e661f54a50c693439240c69658eb5d2afc2cb38e1099c1b3b676fa58bda33b46912ccf416ab01ead55
SSDEEP 3072:sG7dSHYzNZ3jqmC/H0GT/+ctSdCcOXNVLsL:sGhSENZTq9fP/+ctSofJsL
TLSH
T15FB3123669CB8E2C436269EF0DD2139040F7B04358B64A52DF7ECD4F1984E9702769F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan backdoor cobaltstrike

Malware Config

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/74c27e7099f784c0a51c15eada7603b12fb0306cfac88555aea6c2d64bf8f315	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/74c27e7099f784c0a51c15eada7603b12fb0306cfac88555aea6c2d64bf8f315

File Explorer

74c27e7099f784c0a51c15eada7603b12fb0306cfac88555aea6c2d64bf8f315.zip

.zip 111KB
74c27e7099f784c0a51c15eada7603b12fb0306cfac88555aea6c2d64bf8f315

.dll 244KB

74c27e7099f784c0a51c15eada7603b12fb0306cfac88555aea6c2d64bf8f315.zip

SHA256 0fe0a5de490f0fca980fe0188eeffe6c850f816ea4236f59ce4a9a342688750e
MD5 68b77e612f5ad57e71ffb4d075d0a3f6
SHA1 028e60758ed3db63ba1cc86d476fc0800eb54387
SHA512 d359c23d059d66af1ad9437a862734b792f9b67a3e7258e661f54a50c693439240c69658eb5d2afc2cb38e1099c1b3b676fa58bda33b46912ccf416ab01ead55
SSDEEP 3072:sG7dSHYzNZ3jqmC/H0GT/+ctSdCcOXNVLsL:sGhSENZTq9fP/+ctSofJsL
TLSH
T15FB3123669CB8E2C436269EF0DD2139040F7B04358B64A52DF7ECD4F1984E9702769F9
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

74c27e7099f784c0a51c15eada7603b12fb0306cfac88555aea6c2d64bf8f315

IMPHASH 6a6c26505ccc986d1049664aca817a99
SHA256 74c27e7099f784c0a51c15eada7603b12fb0306cfac88555aea6c2d64bf8f315
MD5 620ce06f4980e8a7812e9af955cb1544
SHA1 ba2488a7b91ef6da8bc85e3dc18ee48b3b3d605b
SHA512 075ae62c15f26d8b88498cf8293edf269a49f15b1e1abaf042344ec10ad71527ffb21d50c5d63b5575bee651c2bf2ddfed19226c3b1c19b8e580e1520e1bbc04
SSDEEP 3072:vqcsngEfZwie+k5op78CHyqDW8tZxYQ0S7okfceEYPCGlj1UM5rIi:vnEfOiq5k78CdnPxYQx7oMPC+jG
TLSH
T1CD348C5175D5C132E4560279570BC7728FBDFC342671A4C7BBD81AAA8F222D3DA2A30B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

5

Entry point

89384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

GetThreadContext ReadProcessMemory CreateProcessA TerminateProcess GetCurrentDirectoryW VirtualProtectEx WriteProcessMemory ResumeThread GetFullPathNameA SystemTimeToTzSpecificLocalTime GetLogicalDrives ExpandEnvironmentStringsA GetFileAttributesA FileTimeToSystemTime FindFirstFileA CopyFileA FindClose MoveFileA FindNextFileA VirtualProtect OpenProcess GetCurrentProcessId Thread32First Thread32Next VirtualAllocEx OpenThread CreateToolhelp32Snapshot CreateThread CreateRemoteThread SetThreadContext MapViewOfFile UnmapViewOfFile CreateFileMappingA SetLastError GetVersionExA CreateFileA PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState GetComputerNameA GetACP GetModuleFileNameA GetOEMCP DeleteProcThreadAttributeList CreateNamedPipeA HeapFree GetProcessHeap InitializeProcThreadAttributeList SetErrorMode UpdateProcThreadAttribute ProcessIdToSessionId DuplicateHandle Process32First Process32Next VirtualQuery ExitProcess ExitThread ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetCurrentDirectoryA CreatePipe GetLocalTime GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe MultiByteToWideChar WriteFile GetTickCount WaitForSingleObject Sleep GetModuleHandleA DebugBreak RaiseException GetModuleFileNameW SetEnvironmentVariableW LoadLibraryA VirtualAlloc GetProcAddress SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA HeapSize IsValidCodePage GetCPInfo GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW VirtualFree HeapAlloc FreeLibrary GetModuleHandleW DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode SetHandleCount GetFileType SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings

advapi32

LookupAccountSidA OpenThreadToken CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx OpenProcessToken GetTokenInformation GetUserNameA CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA AdjustTokenPrivileges ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA

wininet

InternetReadFile InternetConnectA InternetQueryDataAvailable InternetSetOptionA HttpOpenRequestA HttpAddRequestHeadersA InternetSetStatusCallback HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA HttpQueryInfoA

ws2_32

closesocket send gethostname WSAStartup socket gethostbyname ntohl htons htonl connect ntohs recv shutdown WSAGetLastError ioctlsocket accept listen __WSAFDIsSet bind select WSACleanup

Sharing