cobaltstrike | 60cbff43545c9367046a95d76cd621e0b69220a94283c16a52257e5ec077e73e[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
60cbff43545c9367046a95d76cd621e0b69220a94283c16a52257e5ec077e73e.zip
Size 105KB
Sample261107-nt92xaeg27
SHA256 a7b135b2ba81f6308c5683cc7f53708f9b49e2fcb4929e9291b71b2800f442f3
MD5 5ac89d9cdb460960a1e43c480b6627d9
SHA1 153ee811204a05c74d7f70cf9741093e5f4d43f0
SHA512 be50f33e34fb48c21d774a0258a39370a688b9803bc1d738dcccfed156f1bfc5d03f8d92413bf14fe602dc08df86b5ea38ed24ffed5ffe7bbade76d9b52f7fe3
SSDEEP 3072:XLlR5foOZzODoWGTwssphu97zfjB8I2ozhCvfimLOlj:Xtfo4zOKTwvU97DuI2wsvKmqlj
TLSH
T1A7B312DC090E88DF5A53070FB43369AD52A4BB359D849709AEAF2FBCA524C5F1E66034
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/60cbff43545c9367046a95d76cd621e0b69220a94283c16a52257e5ec077e73e	cobalt_reflective_dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/60cbff43545c9367046a95d76cd621e0b69220a94283c16a52257e5ec077e73e

File Explorer

60cbff43545c9367046a95d76cd621e0b69220a94283c16a52257e5ec077e73e.zip

.zip 105KB
60cbff43545c9367046a95d76cd621e0b69220a94283c16a52257e5ec077e73e

.dll 210KB

60cbff43545c9367046a95d76cd621e0b69220a94283c16a52257e5ec077e73e.zip

SHA256 a7b135b2ba81f6308c5683cc7f53708f9b49e2fcb4929e9291b71b2800f442f3
MD5 5ac89d9cdb460960a1e43c480b6627d9
SHA1 153ee811204a05c74d7f70cf9741093e5f4d43f0
SHA512 be50f33e34fb48c21d774a0258a39370a688b9803bc1d738dcccfed156f1bfc5d03f8d92413bf14fe602dc08df86b5ea38ed24ffed5ffe7bbade76d9b52f7fe3
SSDEEP 3072:XLlR5foOZzODoWGTwssphu97zfjB8I2ozhCvfimLOlj:Xtfo4zOKTwvU97DuI2wsvKmqlj
TLSH
T1A7B312DC090E88DF5A53070FB43369AD52A4BB359D849709AEAF2FBCA524C5F1E66034
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

60cbff43545c9367046a95d76cd621e0b69220a94283c16a52257e5ec077e73e

IMPHASH cee2783f5b537863eedf6975484fc19a
SHA256 60cbff43545c9367046a95d76cd621e0b69220a94283c16a52257e5ec077e73e
MD5 38dbd5a2e9031817f5e02736931f303e
SHA1 e9fab25af173d1ad555b3e3b4c1274519938f8df
SHA512 d045291789db8052ffa0b382e026cd27009f80039411a39129abb3928b6229aae17d9b459dd2471e346c98f866f08a2d537c8011e14fd062439c08c103f5bfaa
SSDEEP 3072:8T3rHhtE+jdnNW2kxhCmiIe0vT68cXZAk2AxU3icT150e2rbL8Mbb:8TrfxQ2IEmicvT63r2Ac8D
TLSH
T1BC248DA175C2D032E0170474520BC77E9ABDFCF436319997BFC81A5A9E756A3E72A302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

94033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

advapi32

GetUserNameA CloseServiceHandle OpenProcessToken CreateProcessWithLogonW DeleteService CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CreateProcessWithTokenW StartServiceA CreateServiceA

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIfEntry GetIpAddrTable

kernel32

MoveFileA FindNextFileA HeapAlloc HeapFree GetProcessHeap CreateRemoteThread VirtualAlloc VirtualProtectEx VirtualAllocEx ProcessIdToSessionId VirtualProtect DuplicateHandle WriteProcessMemory GetThreadContext SetThreadContext FreeLibrary VirtualFree Thread32First Thread32Next SetLastError LoadLibraryA OpenThread CreateToolhelp32Snapshot SuspendThread ResumeThread PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA FindClose TerminateProcess Process32Next CopyFileA FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA CreateThread GetVersionExA GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe GetEnvironmentVariableA CreateProcessA OpenProcess WriteFile SetFileTime WaitForSingleObject SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile SetEnvironmentVariableW VirtualQuery GetModuleFileNameW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapSize DebugBreak RaiseException QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateFileA GetCurrentProcessId GetLocalTime Sleep Process32First GetTickCount SetFilePointer GetFileType SetHandleCount GetConsoleMode GetModuleHandleW ExitProcess MultiByteToWideChar DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind WideCharToMultiByte GetConsoleCP

kernelbase

DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage

wininet

HttpQueryInfoA InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetQueryOptionA InternetOpenA

ws2_32

htons connect htons socket accept send gethostname inet_ntoa WSAStartup WSACleanup gethostbyname htonl htonl listen __WSAFDIsSet bind recv shutdown WSAGetLastError select ioctlsocket