2026-10-28_587067a80b5df4cc3e3d9d97e23181c1_cobalt-strike_conti

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_587067a80b5df4cc3e3d9d97e23181c1_cobalt-strike_conti
Size 797KB
Sample261030-epe7aswt3k
SHA256 a2e85b8662d94fddeb6738655099c79598c629c06bfd4acf489aa8af3d3b1620
MD5 587067a80b5df4cc3e3d9d97e23181c1
SHA1 42dde4842b80dd975c601744936d37569a317e72
SHA512 338f668b6e239d28d8fbb60e5bec4c98a6d5a30783f86f499f10324d50bbdf69d0ac8e65d8d617d22502db4bae150dc99172eb1cf66bd1bd020e28920a9744b6
SSDEEP 24576:lQB5v1s+QMJ5J5flz9Kkr/yQvlzua1ZVCy8Gr:qv1qMJfdlzEwKQVuVOr
TLSH
T11D05239BC7B2BCA0DE916F348F775A10987773A97470896F061C60596EF0F81E029F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_587067a80b5df4cc3e3d9d97e23181c1_cobalt-strike_conti

File Explorer

2026-10-28_587067a80b5df4cc3e3d9d97e23181c1_cobalt-strike_conti

.exe 797KB

2026-10-28_587067a80b5df4cc3e3d9d97e23181c1_cobalt-strike_conti

IMPHASH 3f13c9efc1c96e846d07d4ba9bbc0f53
SHA256 a2e85b8662d94fddeb6738655099c79598c629c06bfd4acf489aa8af3d3b1620
MD5 587067a80b5df4cc3e3d9d97e23181c1
SHA1 42dde4842b80dd975c601744936d37569a317e72
SHA512 338f668b6e239d28d8fbb60e5bec4c98a6d5a30783f86f499f10324d50bbdf69d0ac8e65d8d617d22502db4bae150dc99172eb1cf66bd1bd020e28920a9744b6
SSDEEP 24576:lQB5v1s+QMJ5J5flz9Kkr/yQvlzua1ZVCy8Gr:qv1qMJfdlzEwKQVuVOr
TLSH
T11D05239BC7B2BCA0DE916F348F775A10987773A97470896F061C60596EF0F81E029F1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegEnumKeyW RegOpenKeyExW RegQueryValueExW

kernel32

AssignProcessToJobObject CloseHandle CreateJobObjectW CreateProcessW DeleteCriticalSection DuplicateHandle EnterCriticalSection FormatMessageW GetBinaryTypeW GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetLastError GetModuleFileNameW GetPrivateProfileStringW GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection MultiByteToWideChar QueryInformationJobObject QueryPerformanceCounter RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SearchPathW SetConsoleCtrlHandler SetEnvironmentVariableW SetInformationJobObject SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObjectEx

msvcrt

__C_specific_handler __iob_func __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _fmode _initterm _onexit _snwprintf_s _vsnwprintf_s _wcmdln _wcsicmp _wcsnicmp _wfopen_s _wgetenv_s _wsplitpath_s abort calloc exit fclose fflush fprintf fputws fread free fwprintf fwrite isspace iswctype malloc memcpy memmove qsort setvbuf signal strlen strncmp vfprintf vfwprintf_s wcscat_s wcschr wcscmp wcscpy_s wcslen wcsncat_s wcsncmp wcsncpy_s wcspbrk wcsrchr wcsstr wcstok_s

shell32

SHGetFolderPathW

Name

.text

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

816B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

784B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

UPX1

Size

759KB

Virtual Size

760KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_587067a80b5df4cc3e3d9d97e23181c1_cobalt-strike_conti

advapi32

kernel32

msvcrt

shell32

generic