MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af9b4003d835cc2f9fbc573c5ac7994cbab3160253b5ea84c38b51452479d724. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	af9b4003d835cc2f9fbc573c5ac7994cbab3160253b5ea84c38b51452479d724
SHA3-384 hash:	cbd9683e9ca8d83291f94490b9847cedb3b86a5e2059518b4cce5f6cf4dab8d7e66b1b23220e15a0c45c0cf9414afc47
SHA1 hash:	0ee4e6426ae29d80b6d782d0c84b685e38bad604
MD5 hash:	03f1fb9238ba31c6433a66cb162efbe1
humanhash:	lima-ack-muppet-west
File name:	03f1fb9238ba31c6433a66cb162efbe1.exe
Download:	download sample
Signature	CobaltStrike Alert Create hunting rule
File size:	19'456 bytes
First seen:	2023-12-24 02:45:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	147442e63270e287ed57d33257638324 (143 x CobaltStrike, 21 x Cobalt Strike)
ssdeep	192:AV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/20FUtWF8qa1Dojjgi:iqaCF31cix+Dc4zjHFBFF46gi
TLSH	T10092FB3FE31358E9C106D57845FB3732DCB17DB385E6A32E2724D2B42E105A46EAE950
TrID	41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 26.1% (.EXE) Win64 Executable (generic) (10523/12/4) 12.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.1% (.ICL) Windows Icons Library (generic) (2059/9) 5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	abuse_ch
Tags:	Cobalt Strike exe

abuse_ch

None C2:
117.73.13.170:8888

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

395

Origin country :

NL

Vendor Threat Intelligence

CAPE Sandbox CobaltStrikeStager

Detection:

CobaltStrikeStager

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/469163/

ClamAV Detected

Detection(s):

Win.Trojan.CobaltStrike-9044898-1

Alert

Create hunting rule

Win.Trojan.CobaltStrike-7899871-1

Alert

Create hunting rule

Win.Countermeasure.LoaderWinGeneric-9804845-2

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug cobaltstrike meterpreter rozena shelma

Link:

https://www.filescan.io/uploads/65879b6b6b1c246046042558/reports/8b2c2344-d170-49b5-b4de-ad959bd990f7/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/af9b4003d835cc2f9fbc573c5ac7994cbab3160253b5ea84c38b51452479d724

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Cobalt Strike

Malware family:

Cobalt Strike

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/82221503-cb01-4424-8a6e-ece618cb29dd

Joe Sandbox CobaltStrike

Result

Threat name:

CobaltStrike

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1366586

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Found API chain indicative of debugger detection

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

95%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/af9b4003d835cc2f9fbc573c5ac7994cbab3160253b5ea84c38b51452479d724

CERT.PL MWDB cobaltstrike

Detection:

cobaltstrike

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/af9b4003d835cc2f9fbc573c5ac7994cbab3160253b5ea84c38b51452479d724/

ReversingLabs TitaniumCloud Win64.Backdoor.CobaltStrike

Threat name:

Win64.Backdoor.CobaltStrike

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-20 13:47:00 UTC

File Type:

PE+ (Exe)

AV detection:

29 of 37 (78.38%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=v6nuaa6ygxgc7h54k46fvr4zjs5lgfqcko26vbgdrniukjdz24sa._file

Threatray cobaltstrike

Verdict:

malicious

Label(s):

cobaltstrike

Alert

Create hunting rule

Hatching Triage cobaltstrike

Result

Malware family:

cobaltstrike

Alert

Create hunting rule

Score:

  10/10

Tags:

family:cobaltstrike backdoor trojan

Link:

https://tria.ge/reports/231224-c9aq7sdgck/

Behaviour

Cobaltstrike

Malware Config

C2 Extraction:

http://117.73.13.170:8888/9tVZ

UnpacMe win_cobaltstrike_pipe_strings_nov_2023

Unpacked files

SH256 hash:

af9b4003d835cc2f9fbc573c5ac7994cbab3160253b5ea84c38b51452479d724

MD5 hash:

03f1fb9238ba31c6433a66cb162efbe1

SHA1 hash:

0ee4e6426ae29d80b6d782d0c84b685e38bad604

Detections:

win_cobaltstrike_pipe_strings_nov_2023

Alert

Create hunting rule

Link:

https://www.unpac.me/results/71da4a5b-79a0-42c2-9953-2fe58e783b82/

VMRay CobaltStrike

Malware family:

CobaltStrike

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/af9b4003d835/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/af9b4003d835cc2f9fbc573c5ac7994cbab3160253b5ea84c38b51452479d724

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/469163/