Trojan CobaltStrike Analysis

Trojan CobaltStrike
Updated on 2023-09-09 (10 months ago)
Checked by Online Virus Scanner
Online Virus Checkerv.
DB Version:2023-09-09 08:01:35

Cobalt Strike is a paid penetration testing tool used by security professionals to deploy an agent called 'Beacon' on a target system. Beacon provides various functionalities to the operator, including command execution, keylogging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning, and lateral movement. Beacon operates in-memory and is file-less, loading itself into a process's memory after exploiting vulnerabilities or executing a shellcode loader, avoiding disk storage. It supports communication and staging over multiple protocols, including HTTP, HTTPS, DNS, SMB named pipes, and both forward and reverse TCP connections, with the capability for daisy-chaining. Additionally, Cobalt Strike includes the Artifact Kit, a toolkit for creating shellcode loaders.

Checked2023-09-09 05:47:28
File Size239616 bytes Removal Removal

Gridinsoft has the capability to identify and eliminate without requiring further user intervention.

  • Start by downloading Gridinsoft Anti-Malware to your computer.
  • Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  • Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  • Click on the "Standard Scan" button.
  • After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  • If prompted, restart your system to complete the removal process.

Portable Executable Info

Image Base:0x10000000
Entry Point:0x10018d0d
Compilation:2023-02-16 10:28:34
Checksum:0x00000000 (Actual: 0x000485ab)
OS Version:5.0
Sign:The PE file does not contain a certificate table.
Imports: KERNEL32, ADVAPI32, WININET, WS2_32,
Exports: 1


Name Virtual Address Virtual Size Raw Size MD5 Entropy
.text 0x00001000 0x000279b5 0x00027a00 bc4fde702bb8603a38bac596d771d126 6.67
.rdata 0x00029000 0x00009c11 0x00009e00 3516895227359ad17d2edc5893b85bbb 6.64
.data 0x00033000 0x0000f020 0x00006a00 1bfee4def43e33f70ddcc78a01affcd9 2.48
.reloc 0x00043000 0x00002060 0x00002200 d552efaf3d3af5c7adc7e2dbcc91e924 5.60

Leave a comment*

Share your thoughts or insights about this file. Do you align with our conclusion?

*Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Please Wait...

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Gridinsoft Anti-Malware