corpus.blog
43,884 blogs · 5,580,801 posts Claim your blog
Record · corpus.blog/posts/01a07df3-86be-7259-8c79-b437664c9973

Deep Malware Analysis of a Multi-Stage Cobalt Strike Loader

Joe Security · published 21 April 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at joesecurity.org Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
42
Words captured
4,038

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh22vobV3sat1ke-z0W61RuznjW2mALlwk_LjWzOdTUPTJjnSwifncZsR9kPUpPTjuvQVK6dn1_ENuFK3Kb3ZNKo29AdyJxuQR0XJPBJ4aNINmY0vBtGj-GeGQ1_xf2jgqDCamgSeY1TdzFjaiJnwMChMx9qBd9Rk4qwi70cTusarLW0XyLYQNZ00N2uxQ/s924/blogpost-cobalt-strike.jpg
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2OOSJNBovzmxI9KtpfH7ETGIsVBj5LnsgK0Ls9t1MD6RcPbtTgjczmxOWvVgAjv236oMyG5HZSg0nm_kl6Hj0fGNRTQsb2AKj-n92xdeDmjeTu03-ZtDKfHfABpnlzPNwYBgDFV_rbDYH3ggEz9i55jkJWzOJNC8H6YtG95TFvTUbBU0hMOAROSmQqIA/s1376/download.jpg
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKTaFm-Dw2g-fZDkpTBm7Zymc8CJithMa9TImo8cDesbUOj6HReAxdEroLxmT3FpNVA3oKgUQKmSMrlocuEkCZRhIyX2j3ceBNHxWzRu2_zJlwtd98OVLDCbTCaq73C713xYlFUZxRS_7EYqR9hLcRx_zk5ALtPCLtY0PisT7tv0hhfws2MJ8se4qx8IQ/s1362/2026-04-21%2010_56_57-Greenshot.png
blogger.googleusercontent.com
https://www.joesandbox.com/joereverser/analysis/download/a7c2dadb-38f4-4163-b327-af33b1f3505d?type=artifacts&artifact=decompiled_dotnet_files
joesandbox.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEidjv8dUgd3fDN16fDbDDvgto8QglI3E6sLW8v3JMKn_BfwmN4_qTT_PNztwpoL40D4Q8EFb8SrdjHjveXwtDiULwJ3wvByr6JfXdOrfn28FUl5K8yectZv9cIU4LBe9q6k1QMxgxVd6HogV1dIqv5XJrqCz0xiLgLG3kX03jhMy74JX2oHNF8CSMqX5m8n/s819/2026-04-16%2019_57_46-.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhxln7Dt8-FSEQNC6aluaPhrFpzrwWNSapyfbZ7yniKDjNdVijtCK8q5568f7uCTXzbiywgO4Onu8bU4h1zV0YeciT2tAoW7tG86C0DBNbNTu2OYxy5JkMzQtT7mR-1GT_l7pFDXs-gWhClWrPrQh9HpPTiFVFB5LyKzgcHu9g_8Nci9x3KHWnzqv59ealt/s824/2026-04-16%2020_00_59-.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEixPdjQAyPDIDShCbeoZzlQIRY5F-i4GENkIVdMg1lWgn2NxsW-zn16HPCf-qvVyJCjqug8x3vrJ_wYJ4dYj7ffqfbMFTWC3HX6-H6UJX0DzqwEhhAjCZIM16P2Dl3WjOjHQB2W-6q3zCu3HOvaMJGSEqF63iLWHeSyUY3XDqr2IC4ReIq48TJv7YaOwb8/s1904/2026-04-21%2011_03_35-Greenshot.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEge0PzN34Dlz9jTw8HOejzq1EoRxc0JUjdnHujvOZy6qVvaWnIrKPJvWI-tRFCD4ZTkkakjkz2E6loTcoApYaqbutrRVDl9IVLkivsB90IHnh4I12pkMVe5VDbRQBjgN66J2ZJ67BM166bpFrf-VgCjSnRHv8ZfaJigSVkqFvZqSSowA5e_5jmpn0CGqv6e/s817/2026-04-16%2020_03_20-.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJ3m2aBX_ydbwXqteLqCb-yCfzT_w-rY8oj5Val25YpYl3rtMB0Md4uhQ2txgy_FU1AtPgIgnbUVmDDjxXG5BnvwLF3b__q9f94PcVczdY5qoMTfrZkMQeRaDfSbzKlnh13AYuf15deqJPxP9FQo-Cdzx7lYbghV2MFwlzKZo_eXd6FPY7S5zyi_oyXmA/s1357/2026-04-21%2011_06_32-C__Users_Federico_Downloads_2026-04-21%2011_03_35-Greenshot.png%20-%20Greenshot%20image%20.png
blogger.googleusercontent.com
https://www.joesandbox.com/joereverser/analysis/download/cda8f8cd-40e6-4770-a317-e60128375ab6?type=html
joesandbox.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgE7XKTjGAlZKnOirNTa2fpzUSjS-Adk-b07V7sxWia_OEzqzDJHzyJjr0mSYqwfPHfVNkHT8yxvcJDFzKahfZVSqQXoEiHSc796T2tHypzQP2HrV2Ftd6OO4HSSforGzlxd8R7C-qRF_O8cugAZn_M5E9fx_uBYfvf718FZErHrRHcg9vvAcdQ1QhfVmU/s1376/download1.jpg
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjquFJNMTsm7tsm2eD-RNmgZbiw2MaWiFz4yPy78l7KxqPBMgn9IxOZ7zw2BFhqGPyFV_y_jliyhAkYs3iQrlZEXXOrfTPCgfLfI2GCKnKwqjnAyUBC_1emtjRrYis-h4k8H5xlK6mibo68eWOgZLOPX80WbI4yA-Kjl1kjWkUczUliawUIfKthlObcGCk/s1354/2026-04-21%2011_12_37-Federico%20-%20File%20Explorer.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnxh_0EGlTwMxZKy1mYUywOyngLxXc4wzV9W7_Bm8j0pWxwEYgI5O9JKF0ReAl1b5GB0Jy5FVgiDGbpHic4SD7i8pivWM3L9ZRxXv_rL98lIqfRJHjYy_8nI3SQPZg4qg8hyw0oV8MJFX8xTL84XMCaV7H_I8VF0DlA7v8uVlpZHpt87vSM-UqTN0_OY2M/s820/2026-04-16%2020_13_51-.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEijTTTscJV6RPzkEEONlhkhESgYKTR-hrfUFazG9XL4NVCNEN4-ldxrd5eQ6meEOKXPuXhZTPrgFSOHka6QeD4GxBhY2xyqUht3UlrWFn_79RvlJRSGMTr2VX74XHYchwOhSS5ww7yzQor9Ipb9lS2U4uMf8N4dkbB6dFwQHylcaqXTzVvIHpaSoeTUjL4/s676/2026-04-21%2011_38_30-Oracle%20VirtualBox%20Manager.png
blogger.googleusercontent.com
https://x64dbg.com/
x64dbg.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJOXtPI1xG-NaZlEerL8HTrSjE1PJ0WP1HBvcyx8w0WI8OXRwrqxve1QbJ1kgJkqn3mH0YF0UA84nblkNMA61pC7tU_8-emBzLboVEA-FUilH1Z9e4mYk4Pd0I8P9Zjxlf6vN8JFVFtj9sl_2hToM8aj5pWnaBFr9rBuW9n_YoAX7ued3-NvPlrrJob_o/s1461/07-x64dbg-stage2-payload-dump.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKqBrh016ZtWuubK9KPB9fO3sQLJX8DX29uZJhvuQEMkpKuTKXa-B3zmMmgaWIINXA_3Pk6ii2HDjjGuBJFXF_1eqpM7jNb4mY_DVdo_wBB83B_ef6rw5xCH4xt9UdzdremMhYdV6UtMmkogGYycQXieASKbbxHoDxVcLsVsYddEEygHiAj_S8G3U74Xs8/s814/2026-04-16%2020_19_36-Downloads%20-%20File%20Explorer.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgY5YNu8VluTCgqZ0myX2n1ecj4HdyUv56NrE0CsrkJQql-0_kQz6jcQiwq0gJaMFzTC6zP6b3raE6vtnIr2COtfrDAcO705ZK3YPQpaEng46j5dgkvMOH2a0rJGg2-zg8jePod-9DkNcy5U3oACMFxhyDZTcrewXKihM8TEoDm6FFTYdnY5zIs46-zaQjq/s815/2026-04-16%2020_20_24-Downloads%20-%20File%20Explorer.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3UknmgY4rnXhMV4a9wsCU5ZRRndDU5d_7bGBcYt9y8eWmVquqnMxcD-WNjJVDow4PBqtlKdqQaW9q-AuZdRx7HgGUfW7gna_me7XBdVnyX5OdqPNn9TpXJuzD8PURSGUh8AZEzPdZz1zb_mgDPvXMl1U-eqdIs6yWYhhVF0x2oUccVYDaZHaBjMZOhLs/s1224/2026-04-21%2014_13_08-HttpOpenRequestA%20risalendo%20il%20call%20stack.docx%20-%20Word.png
blogger.googleusercontent.com
https://github.com/nationalsecurityagency/ghidra
github.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipzxu3T9mIk6FPYXGidvt6Npai5SdIzoBctCckPiNnl1UxVJzrkEWsiYOsvwoEA6Fyxc18G4QBJ13CVax_nTrjtlSVwojF5hbBjHVLPFf_bBJrj0ZW9VzcOwb2l_N7LLPHLaOFyf03rqBR1eRdMd0tUgNeVinMIADTLNODdp9iFbJU7ml6IWESlVd-AZ6_/s823/2026-04-16%2020_25_13-.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgECJAdhJso3bfdVIMcm3Kh9nfBNar9yLXg77sYutvmgax1s77ljrJ9v3hTD5Sx0AeciTHzKh9dLmZuLWNqr-yguuIKTU7yDrc4OViiIrr7_f7BxAYse6t_Z0iZ7ubIk4Eats2sX3kEpdfuwBWLyXTkVTgJWplNvYp7Uqx-fbIiK_k1o1Pwu8r_MJlmNzi8/s1874/2026-04-16%2020_28_57-.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEievWWP9wzHHkJ-2AiGwkqHkRWJ5_QN4x1-Y1GFFDahev_ye9xGcfSJ150gcpdwKeiuHhvYUZwUWg9vVULdePvbQ2cjI-Gzn1U8vRS8FtY-UFZ3p39GtHKwAhfD4r-pnDw7YJof2qIwz9vGmirjeKItrvGZfxXLLA2P9FAsHdI4cCW4vLP6dPhRLUfx10Q/s672/2026-04-21%2013_49_44-Greenshot.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEidQFDHf2ZfL7BXlBStawj8CqkqVW7EFFz0h3c6HB3vFgljjiD8DJTZl7IEd2VmhA9_uhsq_clFRY42Ryk-x29ZUfxK6Tizf0d7fUjR-Qfcn0YUX7RTGgYv8fTTDfwarlicXJB-6Jgmishuf491l2S89stnwzLOC3RaLrbvgRGZNbR6OqclwjKBwKDk1KE/s671/2026-04-21%2013_02_54-HttpOpenRequestA%20risalendo%20il%20call%20stack.docx%20-%20Word.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-TZHmUORxFOsJHUei3pfCjUnvtqkogAp3wM4fuM3kz4CP17EOq3X2lkRS5VrxwLBCdsA-I0A5ngFRTWaAaJLRuxR1RB53ZjFENF_c4Ib7J8cx-0VB0fEWFpuh_cItlXuk3lZ4c17kcnxZx_CLTzXzEH6znZVH6phXE79o5cKXsfEMH62I5QLHm14fBq8/s668/2026-04-21%2013_06_51-HttpOpenRequestA%20risalendo%20il%20call%20stack.docx%20-%20Word.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj05taGU05ohb2VZMQfoNebxRTIix5Hqv2Hbnb7moGsuNpq5zWexYOQZEVL4EDrl_v6P3ljC1Z1lNbMImvKcF4h22FyH8lhwjoPPdNiuEsbRKXj-8LogACHE8Y4mlfNdfY-N3F_kilVADTFtz0-XAVmz77Dq_9XpJSp5bQAFy9cibLrE2Bm0SvLgbSp8gk/s1503/11-x64dbg-stage3-payload-encryption-and-encoding-verification-1.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGnPlozCqHC-p-qCB33kHoAdtJZ8x7k7FTLK6b-AN3wG9dxBI3pQh3iIptL4wkwHuNGJUdLtelaGJpUw5phoj0qAaqdiJM2wpX80Rm5-hVSMGJq263cmGpdJCttCYmJVym79_Q4N-Vx5MisT3PmFlfZlNjus-v1tFDMTVuwKho60qT5ZNe0IEIzZimNoyF/s816/2026-04-16%2020_37_18-44.0.0%20Smoke%20Quartz%2019.%20Jan%202026%20-%20File%20Explorer.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhL5teXEWjhZnmLwVUP9n194ZxJWmKT4BZ1UCEFOgpH_thV0y0VlH-f_Z5tNPnRX0aLEgNgklBj-4oK7uyqqxPMLZOs6zVKpRvoYW7EKJm0W7df_iDFE-ylDQXzPZxv4RwgC2HmNJw_QroH0reFjBsoNd9EzBTEh0ynBiDIM7nUekLdJk60vGzkjmt0iwA/s1323/12-x64dbg-stage3-payload-encryption-and-encoding-verification-2.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhy2vsLmqZgt4F1i3ixK7l0u01YN_WXa9iA9Y6y6yNOyPRAqPHSnSRKwE6n5vyG9_vlh-gK39ldge9TiBA2UstYwHbWfuDNabGLx4oRhurPzKACaWG5uNGgACHV9hCDprGS143VYZ4oH_t-uD6U6RFWSUvCNCMd7_cO_L92dOffo3u8PHkr5ad6gkz1LO4s/s1242/2026-04-16%2020_41_15-_new%203%20-%20Notepad++.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyXJnWKRdzPc3gg4UVTFKrOwefG4SZc-mjDRNi6Er2IKlWvN7F_MS1XAIrKc-dNJSBg3ZCsSEOWbt5-Ag6hTWJhRp2eB7loy7vD9pLeqBFaWiK-GV5zfvLJ5jUJoh-hbaIKM2HUis3kuo5pnpcXVgYtSQ_BWUSwSwmfFaeSvuXAQdLAT9ygIq0wv3ZXu8/s1555/13-x64dbg-stage3-fake-https-server-response-retrived.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhS8j2GfzRXihj8gxeEt9VoQ4giOK3UKQWT2h3P5X6VFMj1-tZfyV5tDr7mD42HQcqryBlPp4nGudHe43CsjGmHgTxNkkYPmftg7riXEnUhyphenhyphenK_poAaNou-eUNq43heOwZg9UJEzOdVR4t279hJcH5-QrEVL49jimHCglxkkCu4w-PCTNXRoESdzCyCokIo/s725/2026-04-21%2014_01_11-Greenshot.png
blogger.googleusercontent.com
https://factordb.com/
factordb.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJIoPp9fGWESdHKpf7IXQIOFRW8LzoSXxShDcLZo1GSubg3nvSverwAUokXIuW7xlRpHl8vBmy7mzZv-TZyqioBVj8Pl44H8KIMPLbMq-cK1-JkpZr7UgBx0Vg4e0zITZQnK49rhi1el3LJFeGpkPocAJwHnWyFRwVXNLNEA0m3LWMGtnzKvBpJEuGJGf9/s809/2026-04-16%2020_51_20-_new%203%20-%20Notepad++.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiGG5VriZnyR3x_xNxt6MBMosHnpxGC-qAXwKBRqP4Q3ekByQXAPDBjoidBeSIjrOjlZY2YZtZCULR0i-rnNkIHiJGj84SXvB0Sc3nGYZX0dbi9MoyMymxSmBIyxTMP4MvFDITh-ThiWSMkRtWx06jSHsru3-37XzmfV6aw6oQLi8WcroCEtATDnS-lRXw/s1920/2026-04-21%2013_14_01-HttpOpenRequestA%20risalendo%20il%20call%20stack.docx%20-%20Word.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiM57TJFAnE4XbXZ92VWw1pKcC0AZv30L0TBstFA-y7ydAimzMghmp5bu0rEs8c7JzSjH_nm7nAtvBuI6z-It6pSdQkt-wHymXI-2ZoTZpc5v5nKr_wGprBnBwr4SNUbOymwtiy8cqxnYtc27liZZYnN5JdmhwTJQ9ZSWnMwHBuzXHCE5TN550ZNHI3sTc/s647/2026-04-21%2014_03_49-Greenshot.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDniBdtBhFfWYwAEBzWn00sMeMmjVHGCscafBkn-cbEFG18Ow0OXp12lydhn6LS_9mGA9F9grUALv98qifXEGKeYO7Qd6Rx8nX6-USDJBTik903c33N_ZHg7gG4a8Jt1YhJ2xlc9oNbOIpI4SW8Qggzu27BmfCioaY8TzXavyKNsAykhhUgBpgN7nKyTc/s658/2026-04-21%2013_21_08-HttpOpenRequestA%20risalendo%20il%20call%20stack.docx%20-%20Word.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIU_eKXxrsoaUGJ65pZREYIfU0CF6u19RqE-i7VLCPKcPm7zw3EJFrhvOvpAb8zCmRuBee-oekQEf5XD81CakPwsEz0vwk4Y_PoaLgRJfulqsDy7aGcK2WpSIfcqcwqJcbqbhbobdWcZhDhuj2Hisuu7kLkfNzUbPtWhhAUUSwcZY61oxcpj7ZFoYA6qz4/s1242/2026-04-16%2020_41_15-_new%203%20-%20Notepad++.png
blogger.googleusercontent.com
https://www.joesandbox.com/analysis/1894688/1/html
joesandbox.com
https://www.joesandbox.com/joereverser/analysis/download/a7c2dadb-38f4-4163-b327-af33b1f3505d?type=html
joesandbox.com
https://www.joesandbox.com/joereverser/analysis/download/a7c2dadb-38f4-4163-b327-af33b1f3505d?type=chathtml
joesandbox.com
https://www.virustotal.com/gui/file/dff61a394c14f23537b490f7ea1530a456c57bca24bfc317691ce118aa34ee6a
virustotal.com
https://www.virustotal.com/gui/file/8bf7886775bfd69b6867b44a6bad2ee06df4243d814c6245975e78bb1ca2f4ab
virustotal.com
Elsewhere on joesecurity.org (2)