Trojan CobaltStrike Analysis
| Online Virus Checker | v.1.0.138.174 |
| DB Version: | 2023-09-12 12:04:41 |
Trojan.Win64.CobaltStrike.bot
Cobalt Strike is a paid penetration testing tool used by security professionals to deploy an agent called 'Beacon' on a target system. Beacon provides various functionalities to the operator, including command execution, keylogging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning, and lateral movement. Beacon operates in-memory and is file-less, loading itself into a process's memory after exploiting vulnerabilities or executing a shellcode loader, avoiding disk storage. It supports communication and staging over multiple protocols, including HTTP, HTTPS, DNS, SMB named pipes, and both forward and reverse TCP connections, with the capability for daisy-chaining. Additionally, Cobalt Strike includes the Artifact Kit, a toolkit for creating shellcode loaders.
| Checked | 2023-09-12 13:24:58 |
| MD5 | 791221dc928aac8ba1f386e8f14e1003 |
| SHA1 | e6a5956b9548a7f797ea9f153ce8d7f7cdd09a4c |
| SHA256 | 67075d91ffc50bc02bde4e68038648232b2efdd567de02f03d319833e1fe1994 |
| SHA512 | 771931099f095d3e85c9771a8542a5ab0d39d856b90380e597a36ea56478d14ec6fa6cb924d377fa8cb2e04796cc721279bc1425f5d7e55ce9bba3bf20daad49 |
| Imphash | c5640c7a22008f949f9bc94a27623f95 |
| File Size | 5544686 bytes |
Trojan.Win64.CobaltStrike.bot Removal
Gridinsoft has the capability to identify and eliminate Trojan.Win64.CobaltStrike.bot without requiring further user intervention.
- Start by downloading Gridinsoft Anti-Malware to your computer.
- Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
- Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
- Click on the "Standard Scan" button.
- After the scanning process is finished, click on "Clean Now" to remove any detected threats.
- If prompted, restart your system to complete the removal process.
Portable Executable Info
 |
99f8909119f22355b3423d4cad169539 c5a2ab820da81f9db77abd76bbd9764e c6c2ccc4f4e0e0f8 |
| Image Base: | 0x140000000 |
| Entry Point: | 0x14000a8c8 |
| Compilation: | 2023-09-12 06:21:47 |
| Checksum: | 0x005500b3 (Actual: 0x005500b3) |
| OS Version: | 5.2 |
| PEiD: | PE32+ executable (GUI) x86-64, for MS Windows |
| Sign: | The PE file does not contain a certificate table. |
| Sections: | 7 |
| Imports: | USER32, COMCTL32, KERNEL32, ADVAPI32, GDI32, |
| Exports: | 0 |
| Resources: | 9 |
Sections
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Entropy |
|---|---|---|---|---|---|
| .text | 0x00001000 | 0x000235d0 | 0x00023600 | 050ad070d74c0ab2baca6ee9c3b61b5d | 6.47 |
| .rdata | 0x00025000 | 0x00011898 | 0x00011a00 | 63654e9513aedb42dfb00f4eff869e8b | 5.71 |
| .data | 0x00037000 | 0x00010398 | 0x00000c00 | b88590ca230f956ba7b5bffcbee69475 | 1.86 |
| .pdata | 0x00048000 | 0x00001de8 | 0x00001e00 | 626ab1518bc3687e03dacd39bbfde649 | 5.39 |
| _RDATA | 0x0004a000 | 0x000000f4 | 0x00000200 | 3fa4bb815d2865eb13ca6b140ccf210f | 1.96 |
| .rsrc | 0x0004b000 | 0x0000f4a0 | 0x0000f600 | 2784d91522dc6ad4eda29c0cce594c90 | 7.56 |
| .reloc | 0x0005b000 | 0x00000748 | 0x00000800 | ab10229e6319ea5b4dde9f2a80ec60f0 | 5.22 |
