cobaltstrike | 8d8f16fe684d7a186159d6713a30ec4652c5a004d6d3d1857575bd129e423d04[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
8d8f16fe684d7a186159d6713a30ec4652c5a004d6d3d1857575bd129e423d04.zip
Size 105KB
Sample261107-mrrl4sbs2s
SHA256 f44e8637d0ffa0f57bf2f9a21802a3aaa21b7f9a2244629f0a2d9b419508fbe4
MD5 4c318308fad3560524722687886bc4da
SHA1 d24575239e25a09051225544642ef56a4b147931
SHA512 5e518111ea6c82a9038f1ab3e3937103dec337bec0d979dabfc0cc88c593a28773681aaf15bd84bca5b169c09107a13c881ae9f56ea05bae1f0661408f8aaed9
SSDEEP 3072:mNXZJhr8j7J4t4dEfnVnTa6chpyjDQOL4:mLJhr83JUIetaknBL4
TLSH
T139B312394A8631BC020C9F6A7E07B1D62DD93C357A19B0C2BB6C9E965BD19E00F641CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/8d8f16fe684d7a186159d6713a30ec4652c5a004d6d3d1857575bd129e423d04	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/8d8f16fe684d7a186159d6713a30ec4652c5a004d6d3d1857575bd129e423d04

File Explorer

8d8f16fe684d7a186159d6713a30ec4652c5a004d6d3d1857575bd129e423d04.zip

.zip 105KB
8d8f16fe684d7a186159d6713a30ec4652c5a004d6d3d1857575bd129e423d04

.dll 210KB

8d8f16fe684d7a186159d6713a30ec4652c5a004d6d3d1857575bd129e423d04.zip

SHA256 f44e8637d0ffa0f57bf2f9a21802a3aaa21b7f9a2244629f0a2d9b419508fbe4
MD5 4c318308fad3560524722687886bc4da
SHA1 d24575239e25a09051225544642ef56a4b147931
SHA512 5e518111ea6c82a9038f1ab3e3937103dec337bec0d979dabfc0cc88c593a28773681aaf15bd84bca5b169c09107a13c881ae9f56ea05bae1f0661408f8aaed9
SSDEEP 3072:mNXZJhr8j7J4t4dEfnVnTa6chpyjDQOL4:mLJhr83JUIetaknBL4
TLSH
T139B312394A8631BC020C9F6A7E07B1D62DD93C357A19B0C2BB6C9E965BD19E00F641CF
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

8d8f16fe684d7a186159d6713a30ec4652c5a004d6d3d1857575bd129e423d04

IMPHASH cee2783f5b537863eedf6975484fc19a
SHA256 8d8f16fe684d7a186159d6713a30ec4652c5a004d6d3d1857575bd129e423d04
MD5 623a538ea4ffe3ea6a9d536194664d38
SHA1 196f5638c32a8787848932d016b587855e0c6ae4
SHA512 0df2f9b4284eb59568b11f7956cc1d18d80cd88715062c748ac2187f46bc2cde6236f3d4a0a2703955b6eb5a10e130b727da90e035249fa816f904237e37424b
SSDEEP 3072:B5Nuf5qXZCeQB0SLQakuRWLuMS0qxQ9U0315rbrbL8Mbb:BnfE10S0zuRWLZgxQjz
TLSH
T12D248CA535D2D032D4571474620AC77E9ABDFCF41632A443BBC81A5A5F762E3EB3A302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

94033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

advapi32

GetUserNameA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

kernel32

MoveFileA FindNextFileA HeapAlloc HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx ProcessIdToSessionId VirtualProtect DuplicateHandle WriteProcessMemory GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError LoadLibraryA OpenThread CreateToolhelp32Snapshot SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA FindClose TerminateProcess Process32Next CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA CreateThread GetVersionExA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe GetEnvironmentVariableA CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile SetEnvironmentVariableW VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapSize DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateFileA GetCurrentProcessId GetLocalTime Sleep Process32First GetTickCount SetFilePointer GetFileType SetHandleCount GetConsoleMode GetModuleHandleW ExitProcess MultiByteToWideChar DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind WideCharToMultiByte GetConsoleCP

kernelbase

DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage

wininet

HttpQueryInfoA InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetQueryOptionA InternetOpenA

ws2_32

htons connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl htonl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket