MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7703da44bf261e65652af462d3d151498066a2dc315a9f6496204e51099b3e65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7703da44bf261e65652af462d3d151498066a2dc315a9f6496204e51099b3e65
SHA3-384 hash: 39ce4332f6c33040dc01a7514bfcff2a234a63497a5e28361b19b5d710aa500836d2963671fafc482602a66767b6a672
SHA1 hash: e56ee2e34943a2c63863e576d33d1fe8bd898a58
MD5 hash: 5f7b046db7f3fbed0c09d4200957bbaf
humanhash: arizona-seventeen-arizona-hydrogen
File name:cs.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:226'816 bytes
First seen:2021-09-22 07:38:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 829da329ce140d873b4a8bde2cbfaa7e (259 x CobaltStrike)
ssdeep 6144:FO2E3nPjJOl3u5PeWdDB8H4bcIL+OQxJ:U2gjQlEPd98qwd
Threatray 518 similar samples on MalwareBazaar
TLSH T19024E0FC3A4FB331C04E58F25DDA09BA4DAAD67B4EC1BF1258E0E365835B01A1B055AD
Reporter drb_ra
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
603
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cobaltstrike_shellcode.exe
Verdict:
Malicious activity
Analysis date:
2021-09-22 07:38:04 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b5ed168e-34a1-47cd-91e2-9e061fa7b0da

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/190094/
Detection(s):
SecuriteInfo.com.Crypt5.BLLV.UNOFFICIAL
Create hunting rule

Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9e98ebaa-a170-4904-b1ee-3c6fd2012635
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/855400
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7703da44bf261e65652af462d3d151498066a2dc315a9f6496204e51099b3e65/
Threat name:
Win32.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2021-09-22 07:38:11 UTC
AV detection:
38 of 45 (84.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o4b5urf7eypgkzjk6rrnhukrjgagniw4gfnj6zewebhfccm3hzsq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
309c96585aeef62c8b562dea5602310df4bbc1a88837a923dccb5e86b248b283
CobaltStrike
32d46b7131714c02c8668a1b821b4b12cd37f6597a56eb01430c22e315c34638
CobaltStrike
61a0bca8460972abed1f283c9e8a78e43e17e5177cc3a826d8d6beb4fcff14c2
CobaltStrike
840dd55418bf2bd428f401ee565f08aef2c92eab8b4709158a845dd981dc090e
CobaltStrike
c1dd2c50a5ca07f1664a0950bcc93b2999bf32b5d11848f368130a43a364cf82
CobaltStrike
dae0d23e076390e35ba012a1b9891a5564107bc4fd96bcb769c276b7318d4b00
CobaltStrike
+ 508 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:1580103824 backdoor trojan
Link:
https://tria.ge/reports/210922-jgem1sbhe8/
Behaviour
Cobaltstrike
Malware Config
C2 Extraction:
http://wsus-link.global.ssl.fastly.net:443/Arrange/v4.12/1GJUQQEHI2
Unpacked files
SH256 hash:
ca008039f5507cef519448b4d723662ebd7d41637f39c42810d61fb149b3d583
MD5 hash:
0dc9959f9224d5be6d86ae71da603fc7
SHA1 hash:
b69a3e86ba1f9f68ceee0e935d327eb91d0dda70
Link:
https://www.unpac.me/results/d7827907-8dec-47d7-b817-a4efe313cd9a/
SH256 hash:
7703da44bf261e65652af462d3d151498066a2dc315a9f6496204e51099b3e65
MD5 hash:
5f7b046db7f3fbed0c09d4200957bbaf
SHA1 hash:
e56ee2e34943a2c63863e576d33d1fe8bd898a58
Link:
https://www.unpac.me/results/d7827907-8dec-47d7-b817-a4efe313cd9a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7703da44bf261e65652af462d3d151498066a2dc315a9f6496204e51099b3e65

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobaltbaltstrike_strike_Payload_XORed
Create hunting rule
Author:Avast Threat Intel Team
Description:Detects CobaltStrike payloads
Reference:https://github.com/avast/ioc
Rule name:HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5
Create hunting rule
Author:Florian Roth
Description:Detects strings found in CobaltStrike shellcode
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Rule name:HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5_RID361D
Create hunting rule
Author:Florian Roth
Description:Detects strings found in malware samples in APT report in DarkHydrus
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/190094/

Comments