MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7
SHA3-384 hash: 1bbf0e83310bbde6698c83520a9ca976b700c9c60c41edfb349671d120b482d1e69c48f49a0162b62b48f782b4415526
SHA1 hash: 65b2e9be5770e294bed07fa9b5ecfdadb94203c3
MD5 hash: 2d438f5ca86f9813dd17346c8865bd4d
humanhash: paris-kitten-low-queen
File name:DD6D.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:361'472 bytes
First seen:2021-03-22 18:28:25 UTC
Last seen:2021-03-22 21:02:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1b5440bc1c3242795924943d26fd4efc (1 x CobaltStrike)
ssdeep 6144:OxN7NO77pzXFZ2m9TqbwWMIyBkq+OF3B:ON7U777Zwb7MIyW4j
TLSH 1874A21386DDFCE6C07055303337A7E0A73EEC306C6AC96F72C85B26946DA26B5523A5
Reporter malware_traffic
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
2
# of downloads :
628
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DD6D.exe
Verdict:
No threats detected
Analysis date:
2021-03-22 18:29:55 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/26f99fcd-8d71-4899-9897-ef03fdaf10be

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/126161/
Detection(s):
SecuriteInfo.com.Variant.Strictor.233413.6447.548.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Result
Threat name:
CobaltStrike Metasploit
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/648369
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Yara detected Metasploit Payload
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7/
Threat name:
Win32.Ransomware.Ryuk
Create hunting rule
Status:
Malicious
First seen:
2021-03-22 18:28:28 UTC
AV detection:
20 of 47 (42.55%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gufq22xcl2a4qoklcgpu2vu4ba67rul6mja5r37nbbmm7eohixlq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210322-h38jp54mmx/
Unpacked files
SH256 hash:
350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7
MD5 hash:
2d438f5ca86f9813dd17346c8865bd4d
SHA1 hash:
65b2e9be5770e294bed07fa9b5ecfdadb94203c3
Link:
https://www.unpac.me/results/eed3ed55-a39b-4db2-aad4-7b1d463c6516/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/126161/

Comments