cobaltstrike | 573fe9aff9085eaa6d50f78e5d5821bd003f26dd8eb6eafb89a8cf8aba47ef78[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
573fe9aff9085eaa6d50f78e5d5821bd003f26dd8eb6eafb89a8cf8aba47ef78.zip
Size 102KB
Sample261019-sqlmcsaz9q
SHA256 dc4a1a6f9bb1e0767302f27faed59a3bdfb5b8e9997e6d12fcd12449723c7244
MD5 b30bc0dbc7271662f7b8af45f936eb84
SHA1 f317e917e013687b45df9a0f6239554d85023bf3
SHA512 8e307493e196f9bce97561ad4c1728a94e9b9fd712a4158818ceefeafa7d3b33b7b2edb1c03d2dcd8aa3a65420f771dbd00073eb0708be54fe2c51b1c22c008b
SSDEEP 3072:CC286JvnCdkiPruwUn7WkAIrLY65ngGVu5IgE:Cf86JvCdPruws73AIHF5gG8IgE
TLSH
T114A302D07B3B4652DDCC825A0DEDCEB472185E45D4A47EEF84E87B643E280D2B3256B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://profiles.incdigest.com:80/ptj
http://cdn.incdigest.com:80/load
http://freepics.incdigest.com:80/updates.rss

Attributes

beacon_type
256
host
profiles.incdigest.com,cdn.incdigest.com,freepics.incdigest.com
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
60000
port_number
80
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCDKvIaoEZ6/qMtWMklnt1HZJdE916kLfK97xLivCgA4A1jQF87DS2fIocnKFjuEN87R/nzzLv5DEpJ7elvprWXenujDeK4Td6/rwBnmPl1V47FgWKHGeSPvkvMx+rwYqZ9xFskBm5cCV2QDIra/wowVSTNQAKMfNFpI90sL/n4ywIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/573fe9aff9085eaa6d50f78e5d5821bd003f26dd8eb6eafb89a8cf8aba47ef78	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/573fe9aff9085eaa6d50f78e5d5821bd003f26dd8eb6eafb89a8cf8aba47ef78

File Explorer

573fe9aff9085eaa6d50f78e5d5821bd003f26dd8eb6eafb89a8cf8aba47ef78.zip

.zip 102KB
573fe9aff9085eaa6d50f78e5d5821bd003f26dd8eb6eafb89a8cf8aba47ef78

.dll 191KB

573fe9aff9085eaa6d50f78e5d5821bd003f26dd8eb6eafb89a8cf8aba47ef78.zip

SHA256 dc4a1a6f9bb1e0767302f27faed59a3bdfb5b8e9997e6d12fcd12449723c7244
MD5 b30bc0dbc7271662f7b8af45f936eb84
SHA1 f317e917e013687b45df9a0f6239554d85023bf3
SHA512 8e307493e196f9bce97561ad4c1728a94e9b9fd712a4158818ceefeafa7d3b33b7b2edb1c03d2dcd8aa3a65420f771dbd00073eb0708be54fe2c51b1c22c008b
SSDEEP 3072:CC286JvnCdkiPruwUn7WkAIrLY65ngGVu5IgE:Cf86JvCdPruws73AIHF5gG8IgE
TLSH
T114A302D07B3B4652DDCC825A0DEDCEB472185E45D4A47EEF84E87B643E280D2B3256B2
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

573fe9aff9085eaa6d50f78e5d5821bd003f26dd8eb6eafb89a8cf8aba47ef78

IMPHASH 44b279bbda1558424b378a71a2ed8452
SHA256 573fe9aff9085eaa6d50f78e5d5821bd003f26dd8eb6eafb89a8cf8aba47ef78
MD5 05b568512c670f3f0ffed30f3d53dc47
SHA1 f65c3e0c015367f6c77272101faf91b039207efe
SHA512 4ca83afe2bd16f7f2e34361a3a1c78249442194328b54e3b6381cf29162c5aad02bb5f609a6f2debd6fb9da381b36062768ffd4693be65493a015314bf346841
SSDEEP 3072:5YxHrALYzDzBbfEOTPNy292JAxnuLoE0kUYWe5q:5Y1zzXZZwdAxucE0R
TLSH
T111148C6672C1E032D05B0034625FC77E9A7CBDF517619983BF981A565E363A3EB2A303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

89154

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

OpenProcess VirtualAllocEx WriteProcessMemory FreeLibrary VirtualFree Thread32First Thread32Next SetLastError VirtualAlloc LoadLibraryA OpenThread CreateToolhelp32Snapshot SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA Process32First TerminateProcess Process32Next ProcessIdToSessionId GetFileAttributesA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA CreateThread GetVersionExA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetWindowsDirectoryA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe GetEnvironmentVariableA CreateProcessA WriteFile SetFileTime WaitForSingleObject CreateFileA GetCurrentProcessId GetLocalTime Sleep SetEndOfFile VirtualQuery GetModuleFileNameW GetProcessHeap SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetTickCount GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapSize DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateRemoteThread FindNextFileA FindClose FindFirstFileA GetStartupInfoA FileTimeToSystemTime SetFilePointer GetFileType SetHandleCount GetConsoleMode HeapFree HeapAlloc GetModuleHandleW ExitProcess MultiByteToWideChar DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind WideCharToMultiByte GetConsoleCP

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextA LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor GetUserNameA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenProcessToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA DeleteService CreateProcessWithLogonW CloseServiceHandle CreateProcessAsUserA

wininet

InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA HttpQueryInfoA

ws2_32

ntohs connect htons socket accept send gethostname inet_ntoa WSAStartup gethostbyname ntohl htonl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket inet_addr closesocket WSACleanup

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage