2026-10-19_3927e9a6e91ad9bee8b92f08dbb66560_amadey_cobalt-strike_coinminer_smoke-loader
- SHA256 ad4e7f5416245977fabd32d84a625b3b5445ee4737ffa7de50e4d80b15b1935b
-
Detects Reflective DLL injection artifacts
General
- Target 2026-10-19_3927e9a6e91ad9bee8b92f08dbb66560_amadey_cobalt-strike_coinminer_smoke-loader
- Size 239KB
- Sample261020-2866fsdf22
- SHA256 ad4e7f5416245977fabd32d84a625b3b5445ee4737ffa7de50e4d80b15b1935b
- MD5 3927e9a6e91ad9bee8b92f08dbb66560
- SHA1 a082739a9db0e6a0ae9295dff84c313c2547c821
- SHA512 767e689c534507e3c913a32677921d3453a4943faccff51bcb33b8d9e26c1734f6687376dbca392d5acf32e30cbbc5105140f4b7379bcacd92fd5c47a17855a4
- SSDEEP 6144:7vw1Vx8EnOkQoHanErBBpe2BQcmDtM1hpjpRJ6h+Utq:7v60ExFXrBe8Ituhpj1Utq
- TLSH T14534AE913895F472D05A0178634BCBB34EBDBC341671A6D7ABC41E9A8F326D3D72A207
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
cobaltstrike
Botnet
-
987654321
C2
-
http://ns1.waveheart.online:53/api/v1/telemetry
Attributes
-
access_type
512
-
beacon_type
256
-
dns_idle
6.737204e+07
-
host
ns1.waveheart.online
-
http_method1
GET
-
http_method2
POST
-
maxdns
225
-
polling_time
10000
-
port_number
53
-
sc_process32
%windir%\syswow64\wbem\wmiprvse.exe
-
sc_process64
%programfiles(x86)%\microsoft\edge\application\msedge.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCew3HE5fAmi/iUbEFz7f7VWVylXMVFIeP2ZRUXIXzPvQnJ6Ngt7XFXDIvYEj2nyxLnHwSDhzYbVHNHdKYIcm0cJeID8VkF7eAv/ETldfb3jb9u4vv3BY0mUmc3QrvfAmqriUBB9iA9NXRBCC5+2A8KPTVkGIAVT5uFLl4D4btAjQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
3.128704512e+09
-
watermark
987654321
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Detects Reflective DLL injection artifacts 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_ReflectiveLoader
File Explorer
-
2026-10-19_3927e9a6e91ad9bee8b92f08dbb66560_amadey_cobalt-strike_coinminer_smoke-loader239KB