cobaltstrike | 74ee1a46f0f7589c5265a47dc018b35ef38523bb1af33a549ee77811ff149634[.]zip

General

Target
74ee1a46f0f7589c5265a47dc018b35ef38523bb1af33a549ee77811ff149634.zip
Size 112KB
Sample261030-atg48sch45
SHA256 8e9c744bb2500d740bc9b312f9dd51694e26e627efe6b7fc65fa0990a8493679
MD5 1cc7c0e9d75fb4c1a7227519b0db79e7
SHA1 82e40dc3a0b843d634cd019a43a652df5778028d
SHA512 e4703f1152d3dea3708f219b9dd431d9e605aa213e1a5d6ee9cf1bc18046aed89248bd8e1eb1888474dea67a96f7144d18bc7f46faa984d445436e1e2c4c6a7d
SSDEEP 3072:4TeqzCYyrvOhmZGge5m+H839VCc/AuPZV:4KqeVvGv0+H839VpouRV
TLSH
T18BB312A04754397BF3B633796E98AD8189460333ADDFB15F196F6681B2788B7360314C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan backdoor cobaltstrike

Malware Config

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/74ee1a46f0f7589c5265a47dc018b35ef38523bb1af33a549ee77811ff149634	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/74ee1a46f0f7589c5265a47dc018b35ef38523bb1af33a549ee77811ff149634

File Explorer

74ee1a46f0f7589c5265a47dc018b35ef38523bb1af33a549ee77811ff149634.zip

.zip 112KB
74ee1a46f0f7589c5265a47dc018b35ef38523bb1af33a549ee77811ff149634

.dll 244KB

74ee1a46f0f7589c5265a47dc018b35ef38523bb1af33a549ee77811ff149634.zip

SHA256 8e9c744bb2500d740bc9b312f9dd51694e26e627efe6b7fc65fa0990a8493679
MD5 1cc7c0e9d75fb4c1a7227519b0db79e7
SHA1 82e40dc3a0b843d634cd019a43a652df5778028d
SHA512 e4703f1152d3dea3708f219b9dd431d9e605aa213e1a5d6ee9cf1bc18046aed89248bd8e1eb1888474dea67a96f7144d18bc7f46faa984d445436e1e2c4c6a7d
SSDEEP 3072:4TeqzCYyrvOhmZGge5m+H839VCc/AuPZV:4KqeVvGv0+H839VpouRV
TLSH
T18BB312A04754397BF3B633796E98AD8189460333ADDFB15F196F6681B2788B7360314C
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

74ee1a46f0f7589c5265a47dc018b35ef38523bb1af33a549ee77811ff149634

IMPHASH b450a8226d3ed9f582c2242845b7b787
SHA256 74ee1a46f0f7589c5265a47dc018b35ef38523bb1af33a549ee77811ff149634
MD5 27904aec20668c6df327b4a6c6f34797
SHA1 2acb768a7161aa54ca9d651f16b2640838e9a515
SHA512 b552f5bef037412c7e7e8fd4df940d9691c837f7715a22fc81fd81719258c47b41a118f81b4fd4c63d3705b5c18091bff8b496ff0b660cbff9d08a958135c532
SSDEEP 3072:9uqmLbuNYNozgji10qpv+yqVFrkJi5VDbtjgURS5Gf:APai+z91Rpv+bFz5ZRjl
TLSH
T19A349D5271D1D032E05701BA620FD7724EBDFC3456355887BBAC0A9A9F727A3DA2A307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

5

Entry point

89512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

ExpandEnvironmentStringsA GetFileAttributesA FileTimeToSystemTime FindFirstFileA CopyFileA FindClose MoveFileA FindNextFileA VirtualProtect CreateRemoteThread OpenProcess VirtualAllocEx LoadLibraryA GetCurrentProcessId Thread32First Thread32Next OpenThread CreateToolhelp32Snapshot CreateThread SetThreadContext MapViewOfFile UnmapViewOfFile VirtualAlloc CreateFileMappingA VirtualFree SetLastError GetVersionExA PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState GetComputerNameA GetACP GetModuleFileNameA GetOEMCP DeleteProcThreadAttributeList HeapAlloc HeapFree GetProcessHeap InitializeProcThreadAttributeList SetErrorMode GetLogicalDrives ProcessIdToSessionId DuplicateHandle Process32First Process32Next VirtualQuery ExitProcess ExitThread SystemTimeToTzSpecificLocalTime GetFullPathNameA ResumeThread WriteProcessMemory VirtualProtectEx GetCurrentDirectoryW TerminateProcess CreateProcessA ReadProcessMemory GetThreadContext GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetLocalTime GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe MultiByteToWideChar WriteFile DebugBreak RaiseException SetEnvironmentVariableW SetFileTime GetTickCount WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA HeapSize IsValidCodePage GetCPInfo GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW CreateFileA Sleep UpdateProcThreadAttribute GetModuleHandleW DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement FreeLibrary InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode SetHandleCount GetFileType SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings GetModuleFileNameW

advapi32

FreeSid DeleteService CreateServiceA CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership RevertToSelf AllocateAndInitializeSid LookupAccountSidA GetTokenInformation RegCloseKey RegEnumKeyA RegEnumValueA RegOpenCurrentUser RegOpenKeyExA GetUserNameA DuplicateTokenEx CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA AdjustTokenPrivileges ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenProcessToken OpenSCManagerA QueryServiceStatus StartServiceA CloseServiceHandle

wininet

InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA HttpQueryInfoA

ws2_32

socket closesocket send gethostname inet_ntoa connect WSACleanup gethostbyname ntohl htons htonl ntohs recv shutdown WSAGetLastError ioctlsocket accept listen __WSAFDIsSet bind select WSAStartup

Sharing