MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8241398b22ba3745b460a7a0c39cb9a86ca258b9283901d42e8dab283acb39b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8241398b22ba3745b460a7a0c39cb9a86ca258b9283901d42e8dab283acb39b
SHA3-384 hash: caabdbc94ae612d6d572e7a262419dfb8244d3c5d64124970339caefda01afe49873912f42fe6078eb0a272884804140
SHA1 hash: 90964a5aba4f3e16f75813b4ebefa86a0aa9add6
MD5 hash: 847cd418729d2239f93acf7e774873f8
humanhash: floor-arkansas-low-sierra
File name:SecuriteInfo.com.Win64.Kryptik.BYP.22574
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:415'224 bytes
First seen:2020-06-25 01:43:08 UTC
Last seen:2020-06-25 12:03:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4e6e403c7fca71180251611a04322a34 (2 x CobaltStrike)
ssdeep 6144:P3hmq2XoWggVC0zZjsQC0Opw6j7vXPYr2p4d:Phm9nVVCzQfD63Yr2i
Threatray 2'666 similar samples on MalwareBazaar
TLSH 37948D7A36B0D5EBE0E1E33CC5776510FB723421790C4AFA5AB541DA5F22095CCEAA70
Reporter SecuriteInfoCom
Tags:CobaltStrike

Code Signing Certificate

Organisation:AI Software a.s.
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:Jun 18 00:00:00 2020 GMT
Valid to:Jun 18 23:59:59 2021 GMT
Serial number: 9A8BCFD05F86B15D0C99F50CF414BD00
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:
Thumbprint:
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
3
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/13877/
Detection(s):
SecuriteInfo.com.Win64.Kryptik.BYP.22574.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a file
Sending a TCP request to an infection source
Unauthorized injection to a system process
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a8241398b22ba3745b460a7a0c39cb9a86ca258b9283901d42e8dab283acb39b/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vasbhgfsforxiw2gbj5ayooltkdmujmlskbzahkc5dnlfa5mwonq._file
Verdict:
malicious
Similar samples:
02f1e585df63c50efe87bd6e752c38a0b44884a6c81347abcf16f87f075bbbdf
CobaltStrike
080ef9f0362e415d3292125aa97d460f0499b6bec9596e2e580aef1fd7576e07
CobaltStrike
3e6c11f27c1309c63abe0a1563c6141ce7b8d8110419c572be46dcb3578db443
CobaltStrike
4d71f1eab01045de9ae76ea248be7746bad70c12ad977eeb6e8f8e46bbce6395
CobaltStrike
88e7b17b889fe2b623121b8e2bba6317979bd79885536b21524e94797b3ed36c
CobaltStrike
9282d409b92e1ebf58829283933edea243f7ccf3b68456139986c7cb5949522d
CobaltStrike
ce83f302a60301e222c23e67a7525106d610c6231c23d747ad4263669c1c88c7
CobaltStrike
e99cc027c77bed5c1414225e39093bde66c654a9adfcca9cb3ddafa266410aea
CobaltStrike
ec06102bf93522b24afce8e7641a0182b4bf0c53861599f22b5ee257ad1ee2d8
CobaltStrike
f8c94e76f4d756924bf929b32f85158bc81911ce4a606af67e37460405e0ad3f
CobaltStrike
+ 2'656 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/200625-gr3ej4vzte/
Behaviour
Suspicious use of WriteProcessMemory
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_cobalt_strike_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/13877/

Comments