cobaltstrike | 4187f3ade0b8afae61261dcf871e611f8bb3eb655d51196a36d6358ff87baba5[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
4187f3ade0b8afae61261dcf871e611f8bb3eb655d51196a36d6358ff87baba5.zip
Size 105KB
Sample261011-lc4sfsfc86
SHA256 6fcf7b30772ca05a7b66be614beea907dce2168fa14fe9322166921120d9d5aa
MD5 511696c096163ccd4f19ca74ddbdc438
SHA1 d4c769b06ae2ab3cf72bee34ca3fae6df3954108
SHA512 16216418b5d73d467fde23d397c42cdc295d5e55642b159ae939c258194fba7aaabf7736194fbd462a84e0b1a55031f783dadb48c3bc845fbf9097fa87581ca0
SSDEEP 3072:F6gjF7mOO1aKSO/ZK0+IjFiGBmaM43Pgij:F68OEKUoYFajPb
TLSH
T14AB3029B4975881F05D2E5A8028FEAC0F22757F379EA05B1759506FBAD0E43CAEE016C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/4187f3ade0b8afae61261dcf871e611f8bb3eb655d51196a36d6358ff87baba5	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/4187f3ade0b8afae61261dcf871e611f8bb3eb655d51196a36d6358ff87baba5

File Explorer

4187f3ade0b8afae61261dcf871e611f8bb3eb655d51196a36d6358ff87baba5.zip

.zip 105KB
4187f3ade0b8afae61261dcf871e611f8bb3eb655d51196a36d6358ff87baba5

.dll 210KB

4187f3ade0b8afae61261dcf871e611f8bb3eb655d51196a36d6358ff87baba5.zip

SHA256 6fcf7b30772ca05a7b66be614beea907dce2168fa14fe9322166921120d9d5aa
MD5 511696c096163ccd4f19ca74ddbdc438
SHA1 d4c769b06ae2ab3cf72bee34ca3fae6df3954108
SHA512 16216418b5d73d467fde23d397c42cdc295d5e55642b159ae939c258194fba7aaabf7736194fbd462a84e0b1a55031f783dadb48c3bc845fbf9097fa87581ca0
SSDEEP 3072:F6gjF7mOO1aKSO/ZK0+IjFiGBmaM43Pgij:F68OEKUoYFajPb
TLSH
T14AB3029B4975881F05D2E5A8028FEAC0F22757F379EA05B1759506FBAD0E43CAEE016C
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

4187f3ade0b8afae61261dcf871e611f8bb3eb655d51196a36d6358ff87baba5

IMPHASH cee2783f5b537863eedf6975484fc19a
SHA256 4187f3ade0b8afae61261dcf871e611f8bb3eb655d51196a36d6358ff87baba5
MD5 512bba7a8485f1670e1f466f98db06db
SHA1 dbadaaccae9643c9bdc9ae5de690ecc2c8387094
SHA512 4fd0d7060878a94db40d0bca6ab2670042c9794d9fa5096d6b29f385cf69ca2c2e40c161dc78c56abba3b99ca66695ce151783d2189d689b8d80a3a18a249118
SSDEEP 3072:xBVef5qHZyOAxbAKBsEGrFEs5sUFYdQdUEM815MvrbL8Mbb:xBV/0lUahGrFz5GdQzi
TLSH
T1BA247CB175C0D032D4570578521BC77E9BBEFCF41A319487BBC41AAA9E75293EB2A302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

94033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

advapi32

GetUserNameA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

kernel32

MoveFileA FindNextFileA HeapAlloc HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx ProcessIdToSessionId VirtualProtect DuplicateHandle WriteProcessMemory GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError LoadLibraryA OpenThread CreateToolhelp32Snapshot SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA FindClose TerminateProcess Process32Next CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA CreateThread GetVersionExA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe GetEnvironmentVariableA CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile SetEnvironmentVariableW VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapSize DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateFileA GetCurrentProcessId GetLocalTime Sleep Process32First GetTickCount SetFilePointer GetFileType SetHandleCount GetConsoleMode GetModuleHandleW ExitProcess MultiByteToWideChar DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind WideCharToMultiByte GetConsoleCP

kernelbase

DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage

wininet

HttpQueryInfoA InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetQueryOptionA InternetOpenA

ws2_32

htons connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl htonl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket