MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b779efc0b5b86952f7ff7ee3d6fd72c1a7b941f5a55641c72ca7dbd18f250ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b779efc0b5b86952f7ff7ee3d6fd72c1a7b941f5a55641c72ca7dbd18f250ae
SHA3-384 hash: 4b1efb7a6966b656cb9cf2ad71d0ce95c86ae66700e702e815c17c4a7963d88be37921253186d6fe886d8963146d79e2
SHA1 hash: 63679e5724a59622c4d2727c6d5feb86169db598
MD5 hash: d8b8d437fea749651f647133013c2e58
humanhash: fourteen-timing-nitrogen-juliet
File name:cobaltstrike.ps1
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:353'291 bytes
First seen:2022-06-20 10:46:37 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 6144:vXCjcs0TZ7zWPmqSAwCD7MLe16NIEH4JkGNtxWdiEZGZEZR6lzntSgDXe:vXC4s0ZvWrfwLe1bzJvtkQEZ5Mw
Threatray 270 similar samples on MalwareBazaar
TLSH T183746B473F5869ADD211F126E62AB0C235E0B62F94A98AD4B7F1D0F518F816138F43E7
Reporter pr0xylife
Tags:CobaltStrike ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
674
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.CobaltStrike-7917400-0
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive greyware mask metasploit meterpreter powershell reflection
Link:
https://www.filescan.io/uploads/62b0506746804683cbb682d5/reports/d39acbde-1f5b-4851-b441-aae85add2d5f/overview
Result
Verdict:
MALICIOUS
Result
Threat name:
CobaltStrike, Metasploit
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1016229
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Sets debug register (to hijack the execution of another thread)
Uses known network protocols on non-standard ports
Yara detected CobaltStrike
Yara detected MetasploitPayload
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b779efc0b5b86952f7ff7ee3d6fd72c1a7b941f5a55641c72ca7dbd18f250ae/
Threat name:
Script-PowerShell.Trojan.Rozena
Create hunting rule
Status:
Malicious
First seen:
2022-06-20 10:47:07 UTC
File Type:
Text (PowerShell)
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dn3z57allodjkl3767xd236xfqnhxfa7ljkwihdszj632ghskcxa._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
2fe7b81253f7726822e0f6ff1a3bacea73ca2356ca4dcb460493586629961ad0
CobaltStrike
496af0522abd6667a524a45cd7f5488d9d2c0c4657bb48f3c42237bd3d4ef233
CobaltStrike
a55dbb26705b65000f18861cc6878dd5b95288f43b2b7a18c1a5131279bfa9b2
CobaltStrike
b107545a730cd8a999d58daac31c59e20c12219c7d999ad05987c5cae0602851
CobaltStrike
d3c07ceb0ca4710adc66bee177fd0ec160b14b4c7c059e680ab4324b455bb08d
CobaltStrike
e98ad2d7da9c7fe8e1e3e399c5e32b3c5b698156d413605c3e62c518acfec697
CobaltStrike
+ 260 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:0 botnet:1234567890 backdoor suricata trojan
Link:
https://tria.ge/reports/220620-mvh45scdhp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Blocklisted process makes network request
Cobaltstrike
suricata: ET MALWARE Cobalt Strike Beacon Observed
Malware Config
C2 Extraction:
http://120.79.114.32:23311/pixel
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1b779efc0b5b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.15
Link:
https://yomi.yoroi.company/submissions/1b779efc0b5b86952f7ff7ee3d6fd72c1a7b941f5a55641c72ca7dbd18f250ae

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:Cobaltbaltstrike_Beacon_Encoded
Create hunting rule
Author:Avast Threat Intel Team
Description:Detects CobaltStrike payloads
Reference:https://github.com/avast/ioc
Rule name:Msfpayloads_msf_ref
Create hunting rule
Author:Florian Roth
Description:Metasploit Payloads - file msf-ref.ps1
Reference:Internal Research
Rule name:Msfpayloads_msf_ref_RID2ED5
Create hunting rule
Author:Florian Roth
Description:Metasploit Payloads - file msf-ref.ps1
Reference:Internal Research
Rule name:SUSP_PowerShell_Base64_Decode
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects PowerShell code to decode Base64 data. This can yield many FP

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments