Gridinsoft Logo

Trojan CobaltStrike Analysis

Trojan CobaltStrike
Updated on 2023-09-09 (1 year ago)
Checked by Online Virus Scanner
Online Virus Checker v.1.0.136.174
DB Version: 2023-09-09 08:01:35

Trojan.Win32.CobaltStrike.bot

Cobalt Strike is a paid penetration testing tool used by security professionals to deploy an agent called 'Beacon' on a target system. Beacon provides various functionalities to the operator, including command execution, keylogging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning, and lateral movement. Beacon operates in-memory and is file-less, loading itself into a process's memory after exploiting vulnerabilities or executing a shellcode loader, avoiding disk storage. It supports communication and staging over multiple protocols, including HTTP, HTTPS, DNS, SMB named pipes, and both forward and reverse TCP connections, with the capability for daisy-chaining. Additionally, Cobalt Strike includes the Artifact Kit, a toolkit for creating shellcode loaders.

Checked 2023-09-09 05:43:58
MD5 05880b43e1aee93d96720a62f6a5ad90
SHA1 af77d40c2cb3573c2b40473916c89bbb9a04365f
SHA256 95ef7c5497d1bb19f2571bad529044f282399c90fdc27d8a77c5ff3aebcf5313
SHA512 6b5b050a6bee7728183deffe3051f113fa31ffcc5394c683563dec8501ddeede3ae58dbe2c91c8e05a50a9a1115bce827e23d48aafdf6a7de3db797d4eba6a9b
Imphash c7269d59926fa4252270f407e4dab043
File Size 1279488 bytes

Trojan.Win32.CobaltStrike.bot Removal

Trojan.Win32.CobaltStrike.bot Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win32.CobaltStrike.bot without requiring further user intervention.

  • Start by downloading Gridinsoft Anti-Malware to your computer.
  • Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  • Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  • Click on the "Standard Scan" button.
  • After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  • If prompted, restart your system to complete the removal process.

Portable Executable Info

Image Base: 0x00400000
Entry Point: 0x00454b00
Compilation: 1970-01-01 00:00:00
Checksum: 0x00000000 (Actual: 0x0014687e)
OS Version: 6.1
PEiD: -
Sign: The PE file does not contain a certificate table.
Sections: 13
Imports: kernel32,
Exports: 0
Resources: 0

Sections

Name Virtual Address Virtual Size Raw Size MD5 Entropy
.text 0x00001000 0x0005ffa0 0x00060000 c9633655664d959129bafa6e31d1f105 6.13
.rdata 0x00061000 0x00065ebc 0x00066000 42c0a270351788a590fec710dc535034 5.55
.data 0x000c7000 0x0002d258 0x00002600 6b5a3385a2f1dae11318d59a5d309d83 3.36
/4 0x000f5000 0x00000119 0x00000200 28a3e9c96b9bb43e6541a26c8f68899b 4.83
/19 0x000f6000 0x000145e9 0x00014600 1055e13d4a44a591eaf059f7614ac182 7.99
/32 0x0010b000 0x00003cd7 0x00003e00 f4587638780b2d1b7db936398882b6ce 7.94
/46 0x0010f000 0x00000030 0x00000200 40cca7c46fc713b4f088e5d440ca7931 0.86
/65 0x00110000 0x000254f2 0x00025600 ee51f11f0a5ef6185e5a88adb41f6983 8.00
/78 0x00136000 0x000127aa 0x00012800 6e935504082ebe6c62796ebc01fbd995 7.98
/90 0x00149000 0x00006321 0x00006400 c2ccaa783209bc15bb09a4afe8068b28 7.92
.idata 0x00150000 0x000003e8 0x00000400 7eb833b1df4ca7232a629e1a378a5210 4.64
.reloc 0x00151000 0x00007a0e 0x00007c00 6b7a298cd35e9cee1905399010be6219 6.50
.symtab 0x00159000 0x0001108e 0x00011200 5613f38311d6ea4c3ffbef841073a907 5.04

Leave a comment *

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.