MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 118e89d8135f0b7a40e9a886ebb89f8f9801d7d734559f0c1ec667322b933259. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 118e89d8135f0b7a40e9a886ebb89f8f9801d7d734559f0c1ec667322b933259
SHA3-384 hash: 1df78545abd556416bdc9338b82bdb13093c98c5d33e51fcde07f09bb4050c3519bf10043f29cbc9532f4414ccd8c14f
SHA1 hash: 424f9f3c6b1f21a763ecf86d661ee8b49ab37e36
MD5 hash: 33556ebd3db67baa7a83435e7eba08d0
humanhash: whiskey-shade-johnny-hot
File name:118e89d8135f0b7a40e9a886ebb89f8f9801d7d734559f0c1ec667322b933259
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:2'146'816 bytes
First seen:2020-09-11 10:04:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1cd364a9e949d5ecebd6c614e64bc545 (16 x Glupteba, 10 x Snatch, 6 x CobaltStrike)
ssdeep 24576:+AvlUuiZTFJs5gvggdFTU8QZjITZ8S+kGlczkdjNcPGJ6C:9quivJsWvggHT1cjITZf+PcWjNcPGUC
Threatray 17 similar samples on MalwareBazaar
TLSH 7DA55B06BCE924FAD6EDE53149B1E6213672746943337BC72EC506BE095ABE43E2D310
Reporter JAMESWT_WT
Tags:47.105.143.181 CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/58643/
Detection(s):
Win.Trojan.CobaltStrike-7913051-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/464057
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/118e89d8135f0b7a40e9a886ebb89f8f9801d7d734559f0c1ec667322b933259/
Threat name:
Win64.Trojan.Cometer
Create hunting rule
Status:
Malicious
First seen:
2020-09-04 16:09:21 UTC
File Type:
PE+ (Exe)
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593
CobaltStrike
2339489be44f93b61688ee3b65d0bd2fede5f6dd494588a6268602d2f006bd16
CobaltStrike
40a2ace8bb6e3d7d50bb346344789c2fafd25490fdaa982134aaacce6f971995
CobaltStrike
463218064d1dfba957ebcbb0abb90782106f6e4b173e7b1c207b20a605ebbab9
CobaltStrike
602c753ee7337a5398df34b82238dd243d6afc9aa0f2d6e75f9d5a98cb609aa9
CobaltStrike
690be9e806f882774ab1347302bd92236a16499f160f37e59992c220466493c0
CobaltStrike
8a99a4c58ef5e27d112f0efb4719abe01bcddb5e516114711ee4991f7922ab5f
CobaltStrike
bd5ebf9632ad17e9a39393ab94ef055307ec053486fe703e2a614de391bc4a65
CobaltStrike
e50d52fbac295a37f0ed0b724d4ddafca8c86bcd2391b4c481d51d5e279afd20
CobaltStrike
fefb3c7053a1332b03a4c0523862e8e387a5065b263cf10cb0d7f33f02afc646
CobaltStrike
+ 7 additional samples on MalwareBazaar
Result
Malware family:
metasploit
Create hunting rule
Score:
  10/10
Tags:
family:metasploit
Link:
https://tria.ge/reports/200911-nm2vtwlc86/
Behaviour
Metasploit family
Malware Config
C2 Extraction:
http://47.105.143.181:8885/wDi8
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
CobaltStrike
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/118e89d8135f0b7a40e9a886ebb89f8f9801d7d734559f0c1ec667322b933259

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/malwrhunterteam/status/1304356354883284992?s=20
Cape
Cape
https://www.capesandbox.com/analysis/58643/

Comments