2026-01-16_930974fb46050759fb7b99c27ac7c65c_cobalt-strike_conti[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2026-01-16_930974fb46050759fb7b99c27ac7c65c_cobalt-strike_conti.exe
Size 1.0MB
Sample261113-nde7laax3x
SHA256 ba4c4ec72f082ac1bebe5d0815d00401e84f2531a14759f20760ca0f784480f4
MD5 69cc8aad0e291df732abee3a23137a6c
SHA1 5febcfb2c4a8cdd339f79ed93f271e2faf0150ec
SHA512 21a6cdf96c4cb51974f795b5dc547366b828b70ac617dd1bd7efb0fb2f45dbaf13eb59ca5e77041e3af9af1e55d28f1a86fb8de4fbaf1918ce2df47c146c5b1d
SSDEEP 12288:DwkuosDcdI1aT9BNucLSA6TKgweg3FwaYkdBe65XwzmR:kkf5CsxKJpwhd5VR
TLSH
T11435F9D85E0EBC33E2416B776E5554C82F799B97340B6A3FA0482618C3D6E8ACED31D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-01-16_930974fb46050759fb7b99c27ac7c65c_cobalt-strike_conti.exe

File Explorer

2026-01-16_930974fb46050759fb7b99c27ac7c65c_cobalt-strike_conti.exe

.exe 1.0MB

2026-01-16_930974fb46050759fb7b99c27ac7c65c_cobalt-strike_conti.exe

IMPHASH 3f13c9efc1c96e846d07d4ba9bbc0f53
SHA256 ba4c4ec72f082ac1bebe5d0815d00401e84f2531a14759f20760ca0f784480f4
MD5 69cc8aad0e291df732abee3a23137a6c
SHA1 5febcfb2c4a8cdd339f79ed93f271e2faf0150ec
SHA512 21a6cdf96c4cb51974f795b5dc547366b828b70ac617dd1bd7efb0fb2f45dbaf13eb59ca5e77041e3af9af1e55d28f1a86fb8de4fbaf1918ce2df47c146c5b1d
SSDEEP 12288:DwkuosDcdI1aT9BNucLSA6TKgweg3FwaYkdBe65XwzmR:kkf5CsxKJpwhd5VR
TLSH
T11435F9D85E0EBC33E2416B776E5554C82F799B97340B6A3FA0482618C3D6E8ACED31D1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegEnumKeyW RegOpenKeyExW RegQueryValueExW

kernel32

AssignProcessToJobObject CloseHandle CreateJobObjectW CreateProcessW DeleteCriticalSection DuplicateHandle EnterCriticalSection FormatMessageW GetBinaryTypeW GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetLastError GetModuleFileNameW GetPrivateProfileStringW GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection MultiByteToWideChar QueryInformationJobObject QueryPerformanceCounter RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SearchPathW SetConsoleCtrlHandler SetEnvironmentVariableW SetInformationJobObject SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObjectEx

msvcrt

__C_specific_handler __iob_func __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _fmode _initterm _onexit _snwprintf_s _vsnwprintf_s _wcmdln _wcsicmp _wcsnicmp _wfopen_s _wgetenv_s _wsplitpath_s abort calloc exit fclose fflush fprintf fputws fread free fwprintf fwrite isspace iswctype malloc memcpy memmove qsort setvbuf signal strlen strncmp vfprintf vfwprintf_s wcscat_s wcschr wcscmp wcscpy_s wcslen wcsncat_s wcsncmp wcsncpy_s wcspbrk wcsrchr wcsstr wcstok_s

shell32

SHGetFolderPathW

Name

.text

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

816B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

784B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

312KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-01-16_930974fb46050759fb7b99c27ac7c65c_cobalt-strike_conti.exe

advapi32

kernel32

msvcrt

shell32

generic