Trojan CobaltStrike Malware Analysis

Online Virus Checkerv.
DB Version:2023-09-09 08:01:35
Available languages:ENESBRFRDEUACN

Scan Your File

Analyze suspicious files to detect malware and automatically share them with our team. You can compress your file into a zip archive (if needed, we use the password "infected" to extract before checking).

Cobalt Strike is a paid penetration testing tool used by security professionals to deploy an agent called 'Beacon' on a target system. Beacon provides various functionalities to the operator, including command execution, keylogging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning, and lateral movement. Beacon operates in-memory and is file-less, loading itself into a process's memory after exploiting vulnerabilities or executing a shellcode loader, avoiding disk storage. It supports communication and staging over multiple protocols, including HTTP, HTTPS, DNS, SMB named pipes, and both forward and reverse TCP connections, with the capability for daisy-chaining. Additionally, Cobalt Strike includes the Artifact Kit, a toolkit for creating shellcode loaders.

Checked:2023-09-09 05:43:58
File Size:1279488 bytes Removal

Gridinsoft has the capability to identify and eliminate without requiring further user intervention.

  • Start by downloading Gridinsoft Anti-Malware to your computer.
  • Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  • Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  • Click on the "Standard Scan" button.
  • After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  • If prompted, restart your system to complete the removal process.

Portable Executable Info

Image Base:0x00400000
Entry Point:0x00454b00
Compilation:1970-01-01 00:00:00
Checksum:0x00000000 (Actual: 0x0014687e)
OS Version:6.1
Sign:The PE file does not contain a certificate table.
Imports: kernel32,
Exports: 0


Name Virtual Address Virtual Size Raw Size MD5 Entropy
.text 0x00001000 0x0005ffa0 0x00060000 c9633655664d959129bafa6e31d1f105 6.13
.rdata 0x00061000 0x00065ebc 0x00066000 42c0a270351788a590fec710dc535034 5.55
.data 0x000c7000 0x0002d258 0x00002600 6b5a3385a2f1dae11318d59a5d309d83 3.36
/4 0x000f5000 0x00000119 0x00000200 28a3e9c96b9bb43e6541a26c8f68899b 4.83
/19 0x000f6000 0x000145e9 0x00014600 1055e13d4a44a591eaf059f7614ac182 7.99
/32 0x0010b000 0x00003cd7 0x00003e00 f4587638780b2d1b7db936398882b6ce 7.94
/46 0x0010f000 0x00000030 0x00000200 40cca7c46fc713b4f088e5d440ca7931 0.86
/65 0x00110000 0x000254f2 0x00025600 ee51f11f0a5ef6185e5a88adb41f6983 8.00
/78 0x00136000 0x000127aa 0x00012800 6e935504082ebe6c62796ebc01fbd995 7.98
/90 0x00149000 0x00006321 0x00006400 c2ccaa783209bc15bb09a4afe8068b28 7.92
.idata 0x00150000 0x000003e8 0x00000400 7eb833b1df4ca7232a629e1a378a5210 4.64
.reloc 0x00151000 0x00007a0e 0x00007c00 6b7a298cd35e9cee1905399010be6219 6.50
.symtab 0x00159000 0x0001108e 0x00011200 5613f38311d6ea4c3ffbef841073a907 5.04

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Gridinsoft Anti-Malware