Gridinsoft Logo

Uploaded_file Trojan CobaltStrike Analysis

Updated 1 year ago
Checked by Malaware Check
uploaded_file

Technical Analysis

File Name uploaded_file
Scanner Version 1.0.136.174
Database Version 2023-09-09 08:01:35 UTC
⚠

Trojan.Win32.CobaltStrike.bot

Malware family: CobaltStrike

Cobalt Strike is a penetration testing framework that deploys the Beacon agent for system control. While designed for legitimate security testing, it provides command execution, keylogging, file transfer, privilege escalation, and lateral movement capabilities. The tool operates in-memory to avoid disk-based detection and supports multiple communication protocols.
N/A
Detection Rate
1,279,488
File Size (bytes)
2023-09-09
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
05880b43e1aee93d96720a62f6a5ad90
SHA1
af77d40c2cb3573c2b40473916c89bbb9a04365f
SHA256
95ef7c5497d1bb19f2571bad529044f282399c90fdc27d8a77c5ff3aebcf5313
SHA512
6b5b050a6bee7728183deffe3051f113fa31ffcc5394c683563dec8501ddeede3ae58dbe2c91c8e05a50a9a1115bce827e23d48aafdf6a7de3db797d4eba6a9b
ImpHash
c7269d59926fa4252270f407e4dab043

PE Analysis

Basic Information

▼
Image Base 0x00400000
Entry Point 0x00454b00
Compilation Time 1970-01-01 00:00:00
Checksum 0x00000000 (Actual: 0x0014687e)
OS Version 6.1
PEiD Signatures No signatures detected
Digital Signature The PE file does not contain a certificate table.
Imports 1 libraries
kernel32
Exports 0 functions
Resources 0 Resources
Sections 13 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 393,120 bytes 393,216 bytes 6.13 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ C9633655664D959129BAFA6E31D1F105
.rdata 0x00061000 417,468 bytes 417,792 bytes 5.55 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 42C0A270351788A590FEC710DC535034
.data 0x000c7000 184,920 bytes 9,728 bytes 3.36 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 6B5A3385A2F1DAE11318D59A5D309D83
/4 0x000f5000 281 bytes 512 bytes 4.83 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 28A3E9C96B9BB43E6541A26C8F68899B
/19 0x000f6000 83,433 bytes 83,456 bytes 7.99 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 1055E13D4A44A591EAF059F7614AC182
/32 0x0010b000 15,575 bytes 15,872 bytes 7.94 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES F4587638780B2D1B7DB936398882B6CE
/46 0x0010f000 48 bytes 512 bytes 0.86 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 40CCA7C46FC713B4F088E5D440CA7931
/65 0x00110000 152,818 bytes 153,088 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES EE51F11F0A5EF6185E5A88ADB41F6983
/78 0x00136000 75,690 bytes 75,776 bytes 7.98 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 6E935504082EBE6C62796EBC01FBD995
/90 0x00149000 25,377 bytes 25,600 bytes 7.92 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES C2CCAA783209BC15BB09A4AFE8068B28
.idata 0x00150000 1,000 bytes 1,024 bytes 4.64 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 7EB833B1DF4CA7232A629E1A378A5210
.reloc 0x00151000 31,246 bytes 31,744 bytes 6.50 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 6B7A298CD35E9CEE1905399010BE6219
.symtab 0x00159000 69,774 bytes 70,144 bytes 5.04 (Normal) IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 5613F38311D6EA4C3FFBEF841073A907
Entropy Analysis Alert

5 section(s) with high entropy (≥7.5) detected - possible packing/encryption

1 section(s) with elevated entropy (≥6.5) - possible compression

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win32.CobaltStrike.bot Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win32.CobaltStrike.bot without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware