cobaltstrike | 22998001c0790db3f4ba74a848b28c194b80ba2a11f6d0629c683f755948f9cb[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
22998001c0790db3f4ba74a848b28c194b80ba2a11f6d0629c683f755948f9cb.zip
Size 120KB
Sample261005-ejj83asgjf
SHA256 b86071bcd22df1b13614b7247465282a468c402779a3f2b9ae19374bfb7ea0c6
MD5 0bc969693eb13480d05fda4a980bd4e0
SHA1 9112f60330ddf7e5c204474faae83e985d5a1ffc
SHA512 0cfb7c7cf4f674d35b9a1eb045b0b7ec535fc1709076b06cad0aa71ceb1a557a250a4e3b90c758715719e78d64a85aa9400b5970e76667a2aa5966d43f1204ac
SSDEEP 3072:2cpE7QHrgsGteXsdm3H2ScT3SLbvaoPfHz7ZAtEUXigH+PKK:2YnEsLXsd+H2JGLbvaQfp4Va
TLSH
T1F2C3125B788961B1B327DE1FD88B8C4EAD901E324FF5F2115ABF30C0B17CE99684951A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

305419896 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

http://119.3.141.162:443/ca

Attributes

access_type
512
beacon_type
2048
host
119.3.141.162
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
60000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCTS0cMG/xXkKf8FArxAtIuT7p+RAOC7TUoE4F9B9Z4/nfV9SS2Q5R69fZqL48rRJ0Da6M2MhOYcwZN756nyujQhKvl4fy3kXNx58nQYGwdD/veJSBGD2sD4UHtQUIecGtaNk7fH7f5qpvgnOhXOLZXKDKyOgxEnpjfG51OyAUhTQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
watermark
305419896

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/22998001c0790db3f4ba74a848b28c194b80ba2a11f6d0629c683f755948f9cb	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/22998001c0790db3f4ba74a848b28c194b80ba2a11f6d0629c683f755948f9cb

File Explorer

22998001c0790db3f4ba74a848b28c194b80ba2a11f6d0629c683f755948f9cb.zip

.zip 120KB
22998001c0790db3f4ba74a848b28c194b80ba2a11f6d0629c683f755948f9cb

.exe 352KB

22998001c0790db3f4ba74a848b28c194b80ba2a11f6d0629c683f755948f9cb.zip

SHA256 b86071bcd22df1b13614b7247465282a468c402779a3f2b9ae19374bfb7ea0c6
MD5 0bc969693eb13480d05fda4a980bd4e0
SHA1 9112f60330ddf7e5c204474faae83e985d5a1ffc
SHA512 0cfb7c7cf4f674d35b9a1eb045b0b7ec535fc1709076b06cad0aa71ceb1a557a250a4e3b90c758715719e78d64a85aa9400b5970e76667a2aa5966d43f1204ac
SSDEEP 3072:2cpE7QHrgsGteXsdm3H2ScT3SLbvaoPfHz7ZAtEUXigH+PKK:2YnEsLXsd+H2JGLbvaQfp4Va
TLSH
T1F2C3125B788961B1B327DE1FD88B8C4EAD901E324FF5F2115ABF30C0B17CE99684951A
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

22998001c0790db3f4ba74a848b28c194b80ba2a11f6d0629c683f755948f9cb

IMPHASH 829da329ce140d873b4a8bde2cbfaa7e
SHA256 22998001c0790db3f4ba74a848b28c194b80ba2a11f6d0629c683f755948f9cb
MD5 571870328310a93080ad52c3e717eb7a
SHA1 123c3ff621177d49755c16f7a61e6e946b513a16
SHA512 20708078cbe4c5039ae1b8ab40ec310424788a43f9ed8570fd223d891f512984c335748821e2468a44c1f40cee1aa102b9e7430cb6abe3452b3c5cdc7287f98c
SSDEEP 3072:wdFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzUhjQUz58:KRYkcrY4MCIt07iPlvU0j
TLSH
T12574C075E932FA14C74B24393449D96F8EEB2E285CF1462EC3508F19494BBC0975F2AB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

36864

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.hxnn

Size

208KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata2

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

22998001c0790db3f4ba74a848b28c194b80ba2a11f6d0629c683f755948f9cb.zip

22998001c0790db3f4ba74a848b28c194b80ba2a11f6d0629c683f755948f9cb

kernel32

msvcrt

generic