Gridinsoft Logo

Trojan CobaltStrike Analysis

Trojan CobaltStrike
Updated on 2023-09-11 (1 year ago)
Checked by Online Virus Scanner
Online Virus Checker v.1.0.138.174
DB Version: 2023-09-10 23:01:43

Trojan.Win64.CobaltStrike.bot

Cobalt Strike is a paid penetration testing tool used by security professionals to deploy an agent called 'Beacon' on a target system. Beacon provides various functionalities to the operator, including command execution, keylogging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning, and lateral movement. Beacon operates in-memory and is file-less, loading itself into a process's memory after exploiting vulnerabilities or executing a shellcode loader, avoiding disk storage. It supports communication and staging over multiple protocols, including HTTP, HTTPS, DNS, SMB named pipes, and both forward and reverse TCP connections, with the capability for daisy-chaining. Additionally, Cobalt Strike includes the Artifact Kit, a toolkit for creating shellcode loaders.

Checked 2023-09-10 21:00:40
MD5 964eeda03f4939d3eff1e45b91ec7e95
SHA1 08f51656b95ddd46897f49fcc1d4df63ff02ff48
SHA256 38e521776834af49ce316afbfa35ed493baf2aa14eaf2cd30bc917154734daef
SHA512 5c93f5d752ea1ae2a61e94a35432e594d7ee65eadf7cd2d9728a5a78c763e8a7a83d6c4e484b5a62fdcb8979b55e10e6e5368e7e0469e462e060974c2484e353
Imphash 66c3b0658aee8083a055771d8886e0ab
File Size 11810948 bytes

Trojan.Win64.CobaltStrike.bot Removal

Trojan.Win64.CobaltStrike.bot Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win64.CobaltStrike.bot without requiring further user intervention.

  • Start by downloading Gridinsoft Anti-Malware to your computer.
  • Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  • Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  • Click on the "Standard Scan" button.
  • After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  • If prompted, restart your system to complete the removal process.

Portable Executable Info

99f8909119f22355b3423d4cad169539
c5a2ab820da81f9db77abd76bbd9764e
c6c2ccc4f4e0e0f8
Image Base: 0x140000000
Entry Point: 0x1401b5cc8
Compilation: 2023-09-08 01:17:01
Checksum: 0x00b52388 (Actual: 0x00b52388)
OS Version: 5.2
PEiD: PE32+ executable (GUI) x86-64, for MS Windows
Sign: The PE file does not contain a certificate table.
Sections: 5
Imports: USER32, COMCTL32, KERNEL32, ADVAPI32, GDI32, IPHLPAPI, msvcrt, PSAPI, SHELL32,
Exports: 0
Resources: 9

Sections

Name Virtual Address Virtual Size Raw Size MD5 Entropy
.text 0x00001000 0x00062000 0x00023a00 dbff4434017588700b0ede0f7209341c 8.00
.sedata 0x00063000 0x00156000 0x00156000 f5caae93e379fc210f434e132e9f1baa 7.61
.idata 0x001b9000 0x00001000 0x00000400 67786fd542da271930437f71f18cbd8f 2.94
.rsrc 0x001ba000 0x00010000 0x0000f600 3e86772f326d107ed076f4049e4f540e 7.53
.sedata 0x001ca000 0x00001000 0x00001000 708001cb8bc514428aebdbe7a9ea04ff 7.98

Leave a comment *

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.