MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61a0bca8460972abed1f283c9e8a78e43e17e5177cc3a826d8d6beb4fcff14c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 11


Intelligence 11 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61a0bca8460972abed1f283c9e8a78e43e17e5177cc3a826d8d6beb4fcff14c2
SHA3-384 hash: 598844624eb42ccea455d8a28f213dc2c276ed65e9f1992b38922bbc0c64c5c1dcb845899ecd40b1bd1b299e78946408
SHA1 hash: 4c13c4bdab4a899ca00808a85f2a888caf2150f4
MD5 hash: a60a142a250b18f447fa8865539bab0c
humanhash: fifteen-jupiter-vegan-speaker
File name:cs.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:226'816 bytes
First seen:2021-09-05 22:38:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 829da329ce140d873b4a8bde2cbfaa7e (259 x CobaltStrike)
ssdeep 6144:EDYVb9w5+4k4nAv8O5S0eU0SMRDPbXH+F8PEL09RYkBX:6Ah4zAL5JeU0SMRDjXjPEL09J
Threatray 511 similar samples on MalwareBazaar
TLSH T11724CF3DB22EE4B2E55B7F340EFBA0769E67CF13828640F57679420B79048F1260761A
Reporter drb_ra
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
565
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cobaltstrike_shellcode.exe
Verdict:
No threats detected
Analysis date:
2021-09-05 22:38:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d40ec3dd-e273-4b0c-8da2-4eb176f4492c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/185486/
Detection(s):
SecuriteInfo.com.Crypt5.BLLV.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sending an HTTP GET request
Sending a UDP request
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/707de00d-31af-4ade-97e9-196bda776328
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/845624
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61a0bca8460972abed1f283c9e8a78e43e17e5177cc3a826d8d6beb4fcff14c2/
Threat name:
Win32.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2021-09-05 22:39:04 UTC
AV detection:
36 of 43 (83.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mgqlzkcgbfzkx3i7fa6j5cty4q7bpzixptb2qjwy227lj7h7ctba._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
309c96585aeef62c8b562dea5602310df4bbc1a88837a923dccb5e86b248b283
CobaltStrike
32d46b7131714c02c8668a1b821b4b12cd37f6597a56eb01430c22e315c34638
CobaltStrike
840dd55418bf2bd428f401ee565f08aef2c92eab8b4709158a845dd981dc090e
CobaltStrike
b610633c3c8bbd28bd27021b942b8e4814466d6886525783bc88f87505ed4182
CobaltStrike
c1dd2c50a5ca07f1664a0950bcc93b2999bf32b5d11848f368130a43a364cf82
CobaltStrike
dae0d23e076390e35ba012a1b9891a5564107bc4fd96bcb769c276b7318d4b00
CobaltStrike
+ 501 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:3051851 backdoor trojan
Link:
https://tria.ge/reports/210905-2kyjeachhp/
Behaviour
Cobaltstrike
Malware Config
C2 Extraction:
http://143.198.146.165:80/access/
Unpacked files
SH256 hash:
dad2a5f764a7f3705f1c2025b74dff5fb7cde59c3475689e3e6ca783886bd81f
MD5 hash:
6ae15c458353d0ef64b6895aadc2da1c
SHA1 hash:
6d3fa5db9ec84a2167f73c128ef2399b840cb97d
Link:
https://www.unpac.me/results/5e553029-0380-459c-a448-d9d79d945021/
SH256 hash:
9aa640a49ec43633fdcf47ad99777bb83e822a17d566e0042a799ae22b097a6a
MD5 hash:
5d2e0f6d0193f159eedb240e129af6f7
SHA1 hash:
8690cc0c1a559969a3763e9a332825c6575a61c5
Link:
https://www.unpac.me/results/5e553029-0380-459c-a448-d9d79d945021/
SH256 hash:
61a0bca8460972abed1f283c9e8a78e43e17e5177cc3a826d8d6beb4fcff14c2
MD5 hash:
a60a142a250b18f447fa8865539bab0c
SHA1 hash:
4c13c4bdab4a899ca00808a85f2a888caf2150f4
Link:
https://www.unpac.me/results/5e553029-0380-459c-a448-d9d79d945021/
Malware family:
Cobalt Strike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/61a0bca84609/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/61a0bca8460972abed1f283c9e8a78e43e17e5177cc3a826d8d6beb4fcff14c2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobaltbaltstrike_strike_Payload_XORed
Create hunting rule
Author:Avast Threat Intel Team
Description:Detects CobaltStrike payloads
Reference:https://github.com/avast/ioc
Rule name:CobaltStrike_Unmodifed_Beacon
Create hunting rule
Author:yara@s3c.za.net
Description:Detects unmodified CobaltStrike beacon DLL
Rule name:crime_win32_csbeacon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Cobalt Strike loader
Reference:https://twitter.com/VK_Intel/status/1239632822358474753
Rule name:CS_beacon
Create hunting rule
Author:Etienne Maynier tek@randhome.io
Rule name:HKTL_CobaltStrike_Beacon_Strings
Create hunting rule
Author:Elastic
Description:Identifies strings used in Cobalt Strike Beacon DLL
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_Meterpreter_inMemory
Create hunting rule
Author:netbiosX, Florian Roth
Description:Detects Meterpreter in-memory
Reference:https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Rule name:HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5
Create hunting rule
Author:Florian Roth
Description:Detects strings found in CobaltStrike shellcode
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Rule name:HKTL_Win_CobaltStrike
Create hunting rule
Author:threatintel@volexity.com
Description:The CobaltStrike malware family.
Reference:https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
Rule name:INDICATOR_SUSPICIOUS_ReflectiveLoader
Create hunting rule
Author:ditekSHen
Description:detects Reflective DLL injection artifacts
Rule name:ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:WiltedTulip_ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:http://www.clearskysec.com/tulip

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/185486/

Comments