MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8db9f9962e7ce0a1ce6754c08eb0d8a4921cd3c790f0099c6c31fc8c87754ee8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 5


Intelligence 5 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8db9f9962e7ce0a1ce6754c08eb0d8a4921cd3c790f0099c6c31fc8c87754ee8
SHA3-384 hash: 6e1f6c5d819739c61dda56d06b141b509ba1d94700834b5b64f2152aa2c1028ab64a213c789e05ee6a5851c93e404b4e
SHA1 hash: 7060936d4b3685a8dfe297215028f22d2ff3f0bc
MD5 hash: 83363600b97724ede854c72595ca2dbe
humanhash: fix-magazine-kansas-lima
File name:4074a8923113c5ffcdcdbaabd7970c73
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:222'208 bytes
First seen:2020-11-17 12:09:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 829da329ce140d873b4a8bde2cbfaa7e (259 x CobaltStrike)
ssdeep 6144:BL2DwXUuSyKxDMxXdqpEEkrVMV+fAh/Df1:tcwXLSLQxXd0kr++oRL1
Threatray 218 similar samples on MalwareBazaar
TLSH 9C24E0787679F9F1E05989F024E9C4B7BE7C42DF07E088658AB4C2E54967E311A0FA34
Reporter seifreed
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Sending a custom TCP request
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8db9f9962e7ce0a1ce6754c08eb0d8a4921cd3c790f0099c6c31fc8c87754ee8/
Threat name:
Win32.Trojan.Rozena
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 12:12:33 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rw47tfroptqkdtthktai5mgyusjbzu6hsdyathdmgh6izb3vj3ua._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
25c30b1001d3799a98ca05248300a94ef66ee506f7d38531098b412be5820c69
CobaltStrike
26b291cedb37d366e5ce3956f35dd7d5c04e7dd85f5a5568df548e2206ea8ef4
CobaltStrike
4c66b4e15fe5162db358fdac31aaa32a59d5e80d9885e7d8a7806ac7f7f91a60
CobaltStrike
607d94ef7add6e89f96f2e364362a41f472475380f840c1d8369d195f6e4df2b
CobaltStrike
834a2c6c37316fdb6598576f4d1626a91c0629e3f9484a8e3c041070ed5d5112
CobaltStrike
8f7b9a377a14260d8bdcc6e18e749013a0c2c09a60d46fa026d77f6d92b7b801
CobaltStrike
c0386bd703de36d4e365a80451c76f2bacead193c4593f8f0390298d7b7a614b
CobaltStrike
c184e1d4519fb81baae09c0ff7f0cc8e2c0a32a44228b3e816f8156ca8034061
CobaltStrike
c9b5341f95cfe0e735ba5c1d01577ba77dce61d95eabe3909310c66c1d2fb465
CobaltStrike
f53fc8ee1359db4a8a7ec51d9fa82c5aa2b9e9c462c7d83151c853dda815c628
CobaltStrike
+ 208 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201117-9fgttjtwns/
Unpacked files
SH256 hash:
8db9f9962e7ce0a1ce6754c08eb0d8a4921cd3c790f0099c6c31fc8c87754ee8
MD5 hash:
83363600b97724ede854c72595ca2dbe
SHA1 hash:
7060936d4b3685a8dfe297215028f22d2ff3f0bc
Link:
https://www.unpac.me/results/42d0071d-13f9-4ccf-bcf3-f41e2515737d/
SH256 hash:
962c3694afedca3d04fa9f124deb778f89477dcd199588d34b301b58a037c0e5
MD5 hash:
3b975b69493e5e8dcd24fa24b6b52d85
SHA1 hash:
e3b92f306ede62554255419c771cb62f1e5fc2df
Link:
https://www.unpac.me/results/42d0071d-13f9-4ccf-bcf3-f41e2515737d/
SH256 hash:
c95feb713b737c279256696f50e01aa9f1741028e6b9530eb55f56f68dc4afc8
MD5 hash:
4e9377a7c2e778775fffe266ea22bdc6
SHA1 hash:
044b7ff75428e6ec0e42037ced7f15beb33a3b93
Link:
https://www.unpac.me/results/42d0071d-13f9-4ccf-bcf3-f41e2515737d/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_DarkHydrus_Jul18_5
Create hunting rule
Author:Florian Roth
Description:Detects strings found in malware samples in APT report in DarkHydrus
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Rule name:CobaltStrike_Unmodifed_Beacon
Create hunting rule
Author:yara@s3c.za.net
Description:Detects unmodified CobaltStrike beacon DLL
Rule name:crime_win32_csbeacon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Cobalt Strike loader
Reference:https://twitter.com/VK_Intel/status/1239632822358474753
Rule name:HKTL_Meterpreter_inMemory
Create hunting rule
Author:netbiosX, Florian Roth
Description:Detects Meterpreter in-memory
Reference:https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Rule name:INDICATOR_SUSPICIOUS_ReflectiveLoader
Create hunting rule
Author:ditekSHen
Description:detects Reflective DLL injection artifacts
Rule name:ReflectiveLoader
Create hunting rule
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:WiltedTulip_ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:http://www.clearskysec.com/tulip

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments