2026-11-01_f335959f4665639161fd046cdc9c98b2_cobalt-strike_conti

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_f335959f4665639161fd046cdc9c98b2_cobalt-strike_conti
Size 79KB
Sample261102-dsa63sss9n
SHA256 1f20a3fc11bb55878648dfde5e9c237ede73fc531dce9013c096d4f3666353d1
MD5 f335959f4665639161fd046cdc9c98b2
SHA1 cf37c22697c789db9b586d6416770dae340ba4cd
SHA512 b1867c28d4a4731220a38aadcd0beb8da42845b5443230fd74c1221a0f168add96cb0a0bb4b4c3df071fe9669345d75347880e9a4e4bc3f436d6c61730ecac98
SSDEEP 1536:MmCBEvF7kuaQjG89wZzjRnnh9ioJEBlU8TTCcgRg5j15H2L6DWaGVE44mLuh8Yn/:MTSFQYjG89wZzjRnh9ioJEnnTGcgRBud
TLSH
T1E6834D7BF38324F5C052C17545DA9373F671FC164230676A9B50E3386E22F91AEAA21B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-01_f335959f4665639161fd046cdc9c98b2_cobalt-strike_conti

.exe 79KB

2026-11-01_f335959f4665639161fd046cdc9c98b2_cobalt-strike_conti

IMPHASH fc87e7c2a84de78d1ad3bd51762a327c
SHA256 1f20a3fc11bb55878648dfde5e9c237ede73fc531dce9013c096d4f3666353d1
MD5 f335959f4665639161fd046cdc9c98b2
SHA1 cf37c22697c789db9b586d6416770dae340ba4cd
SHA512 b1867c28d4a4731220a38aadcd0beb8da42845b5443230fd74c1221a0f168add96cb0a0bb4b4c3df071fe9669345d75347880e9a4e4bc3f436d6c61730ecac98
SSDEEP 1536:MmCBEvF7kuaQjG89wZzjRnnh9ioJEBlU8TTCcgRg5j15H2L6DWaGVE44mLuh8Yn/:MTSFQYjG89wZzjRnh9ioJEnnTGcgRBud
TLSH
T1E6834D7BF38324F5C052C17545DA9373F671FC164230676A9B50E3386E22F91AEAA21B
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

d7:8e:2e:5b:77:7d:46:eb:8d:34:e9:63:d9:97:5c:ec:3d:2d:7a:77:88:b4:86:52:8d:76:85:1d:3b:14:08:16

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Jernej Simončič,O=Jernej Simončič,STREET=Herbersteinova 29,L=Ljubljana,C=SI

Chains

Feb 27, 2023

CN=Jernej Simončič,O=Jernej Simončič,STREET=Herbersteinova 29,L=Ljubljana,C=SI

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=Jernej Simončič,O=Jernej Simončič,STREET=Herbersteinova 29,L=Ljubljana,C=SI

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Jernej Simončič,O=Jernej Simončič,STREET=Herbersteinova 29,L=Ljubljana,C=SI

Serial Number

70:3f:38:4b:e7:0a:dd:9e:6a:17:5d:f4:be:6e:02:fe

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 24, 2021 - Feb 24, 2024

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

libgimp-2.0-0

gimp_file_load gimp_image_set_filename gimp_install_procedure gimp_main gimp_progress_init_printf gimp_progress_update gimp_register_file_handler_mime gimp_register_file_handler_raw gimp_register_magic_load_handler gimp_register_thumbnail_loader gimp_temp_name

libgimpbase-2.0-0

gimp_filename_to_utf8 gimp_locale_directory

advapi32

RegGetValueA

libglib-2.0-0

g_free g_getenv g_spawn_sync g_strconcat g_strdup g_strdup_printf g_unlink

libintl-8

libintl_bind_textdomain_codeset libintl_bindtextdomain libintl_fprintf libintl_gettext libintl_textdomain

kernel32

DeleteCriticalSection EnterCriticalSection GetLastError InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection MultiByteToWideChar SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __argc __argv __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _initterm _onexit _strtoi64 _strtoui64 abort calloc exit fclose fopen fprintf free fwrite getc isspace isxdigit localeconv malloc memcpy memset realloc signal strcmp strlen strncmp strtol strtoul tolower ungetc vfprintf

Name

.text

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_f335959f4665639161fd046cdc9c98b2_cobalt-strike_conti

libgimp-2.0-0

libgimpbase-2.0-0

advapi32

libglib-2.0-0

libintl-8

kernel32

msvcrt

generic