cobaltstrike | 427ab14634f3ce8770b1695aecf64b4d65f4651e8bebe2dee1cdce5ccbad57ea[.]zip

General

Target
427ab14634f3ce8770b1695aecf64b4d65f4651e8bebe2dee1cdce5ccbad57ea.zip
Size 112KB
Sample261023-vt8bmscy5v
SHA256 4281710c131daf5452a2a981f9a1081d448e4524fc0f9a7a3519323d8f192f0c
MD5 299495ca8a096723a90c15083b3f21bc
SHA1 2c4db481a75e141506e6665c9ec3e28a1722a14a
SHA512 18e1c5b4680c799d68fcfd8d9b13580bf92162d81b5b72b46de83e30e048afc3410a85fb189888ea3a694a8b3a8ff9e15d42728c770b6ff7bf1e3d1150987696
SSDEEP 3072:wSLv+0WAvSjbsJ+jEvguuzGBbIsFuwUaHYI:nWNjbscuuzKzF6aH5
TLSH
T126B312A61C75E8C71F9D99BB6A3F441434B08BB3C23723CA6D8E1749F4EDC20E5520A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

1101518270 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

1101518270

Attributes

access_type
512
host
10.10.0.1
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
60000
port_number
80
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD0RiqMywHp9+fXHLNiYDDdDA21d+bNjoHnKHyvNsLrPAIenupyO08LeNWzYd5+huwWFGNFP60bxZzMoBjpvz4/IXlhwCU1InR8z21sSLkgIPBgZoeXDXRHIzZHffaahuQym0/ekwFHuPPYgmkX8ba675dQYhnRIujw/RCOpMiewQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; BOIE9;ENUS)
watermark
1101518270

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/427ab14634f3ce8770b1695aecf64b4d65f4651e8bebe2dee1cdce5ccbad57ea	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/427ab14634f3ce8770b1695aecf64b4d65f4651e8bebe2dee1cdce5ccbad57ea

File Explorer

427ab14634f3ce8770b1695aecf64b4d65f4651e8bebe2dee1cdce5ccbad57ea.zip

.zip 112KB
427ab14634f3ce8770b1695aecf64b4d65f4651e8bebe2dee1cdce5ccbad57ea

.dll 204KB

427ab14634f3ce8770b1695aecf64b4d65f4651e8bebe2dee1cdce5ccbad57ea.zip

SHA256 4281710c131daf5452a2a981f9a1081d448e4524fc0f9a7a3519323d8f192f0c
MD5 299495ca8a096723a90c15083b3f21bc
SHA1 2c4db481a75e141506e6665c9ec3e28a1722a14a
SHA512 18e1c5b4680c799d68fcfd8d9b13580bf92162d81b5b72b46de83e30e048afc3410a85fb189888ea3a694a8b3a8ff9e15d42728c770b6ff7bf1e3d1150987696
SSDEEP 3072:wSLv+0WAvSjbsJ+jEvguuzGBbIsFuwUaHYI:nWNjbscuuzKzF6aH5
TLSH
T126B312A61C75E8C71F9D99BB6A3F441434B08BB3C23723CA6D8E1749F4EDC20E5520A9
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

427ab14634f3ce8770b1695aecf64b4d65f4651e8bebe2dee1cdce5ccbad57ea

IMPHASH b450a8226d3ed9f582c2242845b7b787
SHA256 427ab14634f3ce8770b1695aecf64b4d65f4651e8bebe2dee1cdce5ccbad57ea
MD5 6cb31b7e988327a620db3f1d5bafbd3c
SHA1 529804b2caaf72e89a1bfcf1a27d545428fe858f
SHA512 ed3aac955f2b722f88cf3d2ea94a136da39d0e985701b437eff0f10a2dd91517cc3a8013f168c4e06fa018e717e463865dd86e79a7e212e20df08b0694696d5f
SSDEEP 3072:5dFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzUhjQUE5j:FRYkcrY4MCIt07iPlvU0j
TLSH
T1D4147B9175C1F036D05B0439634BCB724FBDFD3816B19987BB984A9A9E71393DB2A203
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

5

Entry point

89512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

ExpandEnvironmentStringsA GetFileAttributesA FileTimeToSystemTime FindFirstFileA CopyFileA FindClose MoveFileA FindNextFileA VirtualProtect CreateRemoteThread OpenProcess VirtualAllocEx LoadLibraryA GetCurrentProcessId Thread32First Thread32Next OpenThread CreateToolhelp32Snapshot CreateThread SetThreadContext MapViewOfFile UnmapViewOfFile VirtualAlloc CreateFileMappingA VirtualFree SetLastError GetVersionExA PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState GetComputerNameA GetACP GetModuleFileNameA GetOEMCP DeleteProcThreadAttributeList HeapAlloc HeapFree GetProcessHeap InitializeProcThreadAttributeList SetErrorMode GetLogicalDrives ProcessIdToSessionId DuplicateHandle Process32First Process32Next VirtualQuery ExitProcess ExitThread SystemTimeToTzSpecificLocalTime GetFullPathNameA ResumeThread WriteProcessMemory VirtualProtectEx GetCurrentDirectoryW TerminateProcess CreateProcessA ReadProcessMemory GetThreadContext GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetLocalTime GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe MultiByteToWideChar WriteFile DebugBreak RaiseException SetEnvironmentVariableW SetFileTime GetTickCount WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA HeapSize IsValidCodePage GetCPInfo GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW CreateFileA Sleep UpdateProcThreadAttribute GetModuleHandleW DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement FreeLibrary InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode SetHandleCount GetFileType SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings GetModuleFileNameW

advapi32

FreeSid DeleteService CreateServiceA CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership RevertToSelf AllocateAndInitializeSid LookupAccountSidA GetTokenInformation RegCloseKey RegEnumKeyA RegEnumValueA RegOpenCurrentUser RegOpenKeyExA GetUserNameA DuplicateTokenEx CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA AdjustTokenPrivileges ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenProcessToken OpenSCManagerA QueryServiceStatus StartServiceA CloseServiceHandle

wininet

InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA HttpQueryInfoA

ws2_32

socket closesocket send gethostname inet_ntoa connect WSACleanup gethostbyname ntohl htons htonl ntohs recv shutdown WSAGetLastError ioctlsocket accept listen __WSAFDIsSet bind select WSAStartup

Sharing