MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a096b8b01479391027f67776d527798460eaba2404940489dfecedd0559c17a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a096b8b01479391027f67776d527798460eaba2404940489dfecedd0559c17a
SHA3-384 hash: 9b400c0fd318038e615d146d1073f4a81c26bd71b8ba973db0d656cd4ff3bf19f71c5270a9f1e882920816cd70037130
SHA1 hash: bc54400a15000909f3404eef9dd41bb924ac259c
MD5 hash: bdb0f31ae175cad62c019ed443f16045
humanhash: uniform-rugby-equal-nebraska
File name:4a096b8b01479391027f67776d527798460eaba2404940489dfecedd0559c17a.bin
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:5'120 bytes
First seen:2020-09-10 08:54:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'655 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 48:6bgc9JoRp8pW1Gx37d7f7kmlVwOjwWnl44FJgsgCn2S8xSmFoJs5qneOulDTuq:00o2837NkmljJnl410kFoW5NhT
Threatray 25 similar samples on MalwareBazaar
TLSH 5BB1D7275BEC2336DCA2473859B343473774E414AE670BAF19A1926CBC626508B13BE0
Reporter JAMESWT_WT
Tags:154.92.16.126 CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/58332/
Detection(s):
Win.Trojan.CobaltStrike-7913051-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Sending an HTTP GET request
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/462981
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Uses known network protocols on non-standard ports
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a096b8b01479391027f67776d527798460eaba2404940489dfecedd0559c17a/
Threat name:
ByteCode-MSIL.Backdoor.Meterpreter
Create hunting rule
Status:
Malicious
First seen:
2020-09-09 16:38:55 UTC
File Type:
PE (.Net Exe)
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
3e895013e36b5d95cac2afc77745b118406219e530a714afc95c91f26f4a3956
CobaltStrike
3fb0587d38c59d7b15929a1566fafc764271cfe54f1e117e87f02617a112eafa
CobaltStrike
4b459c85c8425e368325d8844148e6a058d350374eb721a3da26c4e85ba26973
CobaltStrike
4c830a4247fc3203fbc7fde4ec81d002fd4899cac3e364a7cb30d15bf09c147e
CobaltStrike
60b57a5e5fe515104f57a44c136e7ddaac0d72b099c3959a26493b8c47f66e3f
CobaltStrike
8a148932d87847341a5cc3e93ba144ea1332229a4334a951449b7458169533bc
CobaltStrike
c83163a6e61b2bf3852b426f8ccccac4044d57b2b4514125624632e836f51660
CobaltStrike
d98c29847ea4a1acbc30f95ede18759d9f2ed343dd99d85a542efdf23fd497e5
CobaltStrike
f15491b940bdf60bc4e906b0c333ea3f7a7f38079a906b80a212901eb5ce0152
CobaltStrike
ff086b18973ef9d1075c1a5ca6867382566e2d6e4bd4df444eefdb3f8745f454
CobaltStrike
+ 15 additional samples on MalwareBazaar
Result
Malware family:
metasploit
Create hunting rule
Score:
  10/10
Tags:
family:metasploit
Link:
https://tria.ge/reports/200910-amdm8jhs5a/
Behaviour
Metasploit family
Malware Config
C2 Extraction:
http://154.92.16.126:7779/ZWy2
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4a096b8b01479391027f67776d527798460eaba2404940489dfecedd0559c17a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/malwrhunterteam/status/1303645607861551111?s=20
Cape
Cape
https://www.capesandbox.com/analysis/58332/

Comments