cobaltstrike | fbf13385decffb3c833bdfdeec213d2300d8a02738d1348479f124d789256d7d[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
fbf13385decffb3c833bdfdeec213d2300d8a02738d1348479f124d789256d7d.zip
Size 105KB
Sample261107-nt78babt5s
SHA256 e70eba9a61e346d8953280c742d3a6893133fff808ba790239cce43dfe5ed8f8
MD5 ea2d22c3b192fe47fbce87b2fb7becd9
SHA1 7b84ca791979a766ec174b881265ac3e22ad3e77
SHA512 a11983f956efa4173728914a4b0e459d8d91d72381fa17438e9701379b902d56669af58eee15144955ac69169db99ddc6dbe1f4dddebfff821c525cdfb51bd6f
SSDEEP 1536:sdAePJ/meTCrq3o9w++BEaYrgy4VA41IAG11ib3RGOPS7wF6UbPjpdy+bGPbONSj:sBB/mCCB6ygzVA0GLqLPMwEUrjyj4XpS
TLSH
T19FB312F21F78EE17920A663801C15BA86FD188E76F534063FE38D9258475A2192E5BCB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/fbf13385decffb3c833bdfdeec213d2300d8a02738d1348479f124d789256d7d	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fbf13385decffb3c833bdfdeec213d2300d8a02738d1348479f124d789256d7d

File Explorer

fbf13385decffb3c833bdfdeec213d2300d8a02738d1348479f124d789256d7d.zip

.zip 105KB
fbf13385decffb3c833bdfdeec213d2300d8a02738d1348479f124d789256d7d

.dll 210KB

fbf13385decffb3c833bdfdeec213d2300d8a02738d1348479f124d789256d7d.zip

SHA256 e70eba9a61e346d8953280c742d3a6893133fff808ba790239cce43dfe5ed8f8
MD5 ea2d22c3b192fe47fbce87b2fb7becd9
SHA1 7b84ca791979a766ec174b881265ac3e22ad3e77
SHA512 a11983f956efa4173728914a4b0e459d8d91d72381fa17438e9701379b902d56669af58eee15144955ac69169db99ddc6dbe1f4dddebfff821c525cdfb51bd6f
SSDEEP 1536:sdAePJ/meTCrq3o9w++BEaYrgy4VA41IAG11ib3RGOPS7wF6UbPjpdy+bGPbONSj:sBB/mCCB6ygzVA0GLqLPMwEUrjyj4XpS
TLSH
T19FB312F21F78EE17920A663801C15BA86FD188E76F534063FE38D9258475A2192E5BCB
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

fbf13385decffb3c833bdfdeec213d2300d8a02738d1348479f124d789256d7d

IMPHASH cee2783f5b537863eedf6975484fc19a
SHA256 fbf13385decffb3c833bdfdeec213d2300d8a02738d1348479f124d789256d7d
MD5 61f5a2584abe2957f0ee7a1964f2a995
SHA1 dded13b13d7f28662a67473b93b98f12f4b06736
SHA512 6a09572f3946d55fa853cf7505462908ff2c9e049dd5992d31b540e3eb4f960ef3de1b1b47482fe93fa0f11b5458318de829982aee9f6f53be5e0e500145f955
SSDEEP 3072:xBVef5qHZyOAxbAKBsEGrFEs5sUFYdQdUEM815uvrbL8Mbb:xBV/0lUahGrFz5GdQz8
TLSH
T19F247CB175C0D032D4570578521BC77E5BBEFCF41A329487BBC41AAA9E75293EB2A302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

94033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

advapi32

GetUserNameA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

kernel32

MoveFileA FindNextFileA HeapAlloc HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx ProcessIdToSessionId VirtualProtect DuplicateHandle WriteProcessMemory GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError LoadLibraryA OpenThread CreateToolhelp32Snapshot SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA FindClose TerminateProcess Process32Next CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA CreateThread GetVersionExA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe GetEnvironmentVariableA CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile SetEnvironmentVariableW VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapSize DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateFileA GetCurrentProcessId GetLocalTime Sleep Process32First GetTickCount SetFilePointer GetFileType SetHandleCount GetConsoleMode GetModuleHandleW ExitProcess MultiByteToWideChar DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind WideCharToMultiByte GetConsoleCP

kernelbase

DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage

wininet

HttpQueryInfoA InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetQueryOptionA InternetOpenA

ws2_32

htons connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl htonl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket