MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6afab1df3de00b1200198e692eae6dc36373c310cf4102ecacc5c6e8ff89a7e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6afab1df3de00b1200198e692eae6dc36373c310cf4102ecacc5c6e8ff89a7e8
SHA3-384 hash: c2c109a6c7fb4a7ebd63329bedc57d6f66abb5c17054ecf4b8bae78c507bdc84f5bab5dadf30171bef37bd736e887272
SHA1 hash: 8c5a737481b50108e16f2494a3621901fc59a367
MD5 hash: db9214c2f8340ceba664800481f0ca08
humanhash: edward-spaghetti-oklahoma-low
File name:6afab1df3de00b1200198e692eae6dc36373c310cf4102ecacc5c6e8ff89a7e8
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:225'792 bytes
First seen:2021-04-02 11:21:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 829da329ce140d873b4a8bde2cbfaa7e (259 x CobaltStrike)
ssdeep 3072:Z1s9brqJYqUkOVXfF9ffI0bKuAjYRZZczSvj6HtAkfxIKdckUDjAuSUp1Bj:Z1wKokOVXDI0OuAs76SCAp1SAj
Threatray 211 similar samples on MalwareBazaar
TLSH 2324DFF5A60A5ACDD8267D75E8E4A5A09F26FD3F7A0EF22C9EC0800191C31DF075A784
Reporter JAMESWT_WT
Tags:54.75.3.205 CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
533
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cobaltstrike_shellcode.exe
Verdict:
No threats detected
Analysis date:
2021-03-30 13:46:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/14d750f6-b80b-436e-b170-bea6a8bc7725

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/131703/
Detection(s):
SecuriteInfo.com.Crypt5.BLLV.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/663740
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6afab1df3de00b1200198e692eae6dc36373c310cf4102ecacc5c6e8ff89a7e8/
Threat name:
Win32.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2021-03-30 21:16:00 UTC
File Type:
PE (Exe)
AV detection:
43 of 48 (89.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nl5ldxz54afreaazrzus5ltnynrxhqyqz5aqf3fmyxdor74ju7ua._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
057d811888e41fca0d05d8f27f0f761651ff379a207ce67774e5f75253efc236
CobaltStrike
0e30a27d44484b9baa56e7b6050581e3edc3bd1b426057c85824d0cac493a3f1
CobaltStrike
10b429dee7953e57c10798ffe22a196f768557cfb34e7fb338310d19cbfa09a6
CobaltStrike
4598fc224cd68101ae1aa21a42dea35d204c8c00469d39fd4ce09b05c48eee0a
CobaltStrike
af3f3371e861b0d5225069256c8561217a2f3ecd5dde0554e2856e4e15222bd5
CobaltStrike
b094885ad9576befcc251800a32d8d2c118b58c9eddc2ee3b74a4a54f178c715
CobaltStrike
d963d9065339a7172882cb7ad0d3125f4f56aad05fe6fd05a12d7b3feb1d4f80
CobaltStrike
e844577efbd9d78da8849997491807f1f9d3ae7d7f010363e2c25c6de2687eba
CobaltStrike
e8b23f70120b69886cd4ec64fc1dea36c4c9d6ee0d07d31c83e34e4a56ede56f
CobaltStrike
f4ca63aeb4e3246c5d923942497d650bc3920c9fbc78a330ecf9d7db67e0cb8f
CobaltStrike
+ 201 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike backdoor trojan
Link:
https://tria.ge/reports/210402-nfaawnjrma/
Behaviour
Cobaltstrike
Malware Config
C2 Extraction:
http://medical-journey.com:443/_gallery-01.gif
Unpacked files
SH256 hash:
2b2cf05cd8d3e991dcd6532e77a4583d3bf4e3a7cd170dd38c8feb72f9decd60
MD5 hash:
0309247d6636d30b9d61bb3e8e6a23da
SHA1 hash:
995581f2c96044cde614945dec34d701ad29b996
Link:
https://www.unpac.me/results/26bcee59-7771-4ce0-8c97-ebf7f6e515de/
SH256 hash:
6afab1df3de00b1200198e692eae6dc36373c310cf4102ecacc5c6e8ff89a7e8
MD5 hash:
db9214c2f8340ceba664800481f0ca08
SHA1 hash:
8c5a737481b50108e16f2494a3621901fc59a367
Link:
https://www.unpac.me/results/26bcee59-7771-4ce0-8c97-ebf7f6e515de/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
CobaltStrike
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6afab1df3de00b1200198e692eae6dc36373c310cf4102ecacc5c6e8ff89a7e8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_DarkHydrus_Jul18_5
Create hunting rule
Author:Florian Roth
Description:Detects strings found in malware samples in APT report in DarkHydrus
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/131703/

Comments