MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b239b5d05aba2f98cbc955c1b88884495db53f5b3a3381b94db1aa76e3ed67a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CobaltStrike

Vendor detections: 13

Intelligence 13 IOCs YARA 19 File information Comments

SHA256 hash:	b239b5d05aba2f98cbc955c1b88884495db53f5b3a3381b94db1aa76e3ed67a1
SHA3-384 hash:	21a734e398f2308188b026b7de4c2e0b5dd326de459ab7fba7e97daed0444d103ad579026f13bdbe851ad8364eae4a69
SHA1 hash:	0dcaf764946746594f14e4c1f75ec7b47f8a1257
MD5 hash:	62a4aa621e034dbdaaf2bef8f5a4aef0
humanhash:	river-johnny-rugby-uranus
File name:	SecuriteInfo.com.BackDoor.Meterpreter.157.5399.3185
Download:	download sample
Signature	CobaltStrike Create hunting rule
File size:	437'136 bytes
First seen:	2022-09-28 05:00:00 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	974b46aac09fd69de98c5361efb17a61 (1 x CobaltStrike)
ssdeep	12288:nOYO68aew0lMKTKK4KKDyK5FZ1EEEEmEEE1EEEEEEEEEEElKK1KKK1KKK7:NOb2KTKK4KKDyK5FZ1EEEEmEEE1EEEEE
Threatray	1'900 similar samples on MalwareBazaar
TLSH	T19194C52A3852F2C4FBC177B45655A6F0437B7C322D3AE6EE05B032651FB64D7CA21826
TrID	48.7% (.EXE) Win64 Executable (generic) (10523/12/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):
dhash icon	c488b8f0e2b692cc (2 x CobaltStrike, 1 x ValleyRAT)
Reporter	SecuriteInfoCom
Tags:	CobaltStrike exe

Intelligence

File Origin

# of uploads :

# of downloads :

625

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/314199/

Detection(s):

SecuriteInfo.com.BackDoor.Meterpreter.157.5399.3185.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Launching a process

Sending an HTTP GET request

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/39637/overview

Behaviour

MalwareBazaar

MeasuringTime

GetTempPath

CheckCmdLine

EvasionQueryPerformanceCounter

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

cobalt exploit greyware overlay packed rozena

Link:

https://www.filescan.io/uploads/6333d4d30d3d21420cc9550e/reports/3f98d53e-02f7-4e59-9269-78ce1420e195/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/03995675-08fa-477b-87c0-4e3f7d33837c

Result

Threat name:

CobaltStrike

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1078906

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contain functionality to detect virtual machines

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Uses known network protocols on non-standard ports

Yara detected CobaltStrike

Behaviour

Behavior Graph:

Download SVG

Detection:

cobaltstrike

Link:

https://mwdb.cert.pl/sample/b239b5d05aba2f98cbc955c1b88884495db53f5b3a3381b94db1aa76e3ed67a1/

Threat name:

Win64.Trojan.Swrort

Status:

Malicious

First seen:

2022-09-20 02:47:33 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

20 of 26 (76.92%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wi43luc2xixzrs6jkxa3rceejfo3kp23hizydoknwgvhny7nm6qq._file

Verdict:

malicious

Label(s):

cobaltstrike

CobaltStrike

8344424b2ab65b90171d02df7f9f8625308284c4b25e0e489c005f9c164784c2

CobaltStrike

96f1143875956621e590d05da84a3b75d498ecbf6afda44208894c2f51a8464b

CobaltStrike

d3f1d658545c3726233e696e3cea4d66d9a515d60f551ea01abfda00552e17da

CobaltStrike

da745a98fcd59b61e6365661a809bc8abf2c029863cd6ade3c4ccb2115cd0ee2

CobaltStrike

e292bf04e0c03341436ab4411ddde881129db4904ae2234952f3a655f14d5cb7

CobaltStrike

+ 1'890 additional samples on MalwareBazaar

Result

Malware family:

cobaltstrike

Score:

10/10

Tags:

family:cobaltstrike backdoor trojan

Link:

https://tria.ge/reports/220928-fmznlafag6/

Behaviour

Cobaltstrike

Malware Config

C2 Extraction:

http://114.116.101.84:85/bootstrap.min.js

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/aa6d9094-d875-41b2-9fb8-e13229f3fc6d

Unpacked files

SH256 hash:

b239b5d05aba2f98cbc955c1b88884495db53f5b3a3381b94db1aa76e3ed67a1

MD5 hash:

62a4aa621e034dbdaaf2bef8f5a4aef0

SHA1 hash:

0dcaf764946746594f14e4c1f75ec7b47f8a1257

Link:

https://www.unpac.me/results/fcc9c1d8-5578-4b1e-8f43-930a196c5034/

Malware family:

CobaltStrike

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b239b5d05aba/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b239b5d05aba2f98cbc955c1b88884495db53f5b3a3381b94db1aa76e3ed67a1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobaltbaltstrike_Beacon_x64 Create hunting rule
Author:	Avast Threat Intel Team
Description:	Detects CobaltStrike payloads
Reference:	https://github.com/avast/ioc

Rule name:	CobaltStrikeBeacon Create hunting rule
Author:	ditekshen, enzo & Elastic
Description:	Cobalt Strike Beacon Payload

Rule name:	CobaltStrike_C2_Encoded_XOR_Config_Indicator Create hunting rule
Author:	yara@s3c.za.net
Description:	Detects CobaltStrike C2 encoded profile configuration

Rule name:	CobaltStrike_MZ_Launcher Create hunting rule
Author:	yara@s3c.za.net
Description:	Detects CobaltStrike MZ header ReflectiveLoader launcher

Rule name:	CobaltStrike_Sleep_Decoder_Indicator Create hunting rule
Author:	yara@s3c.za.net
Description:	Detects CobaltStrike sleep_mask decoder

Rule name:	HKTL_CobaltStrike_Beacon_4_2_Decrypt Create hunting rule
Author:	Elastic
Description:	Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2
Reference:	https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures

Rule name:	HKTL_CobaltStrike_Beacon_Strings Create hunting rule
Author:	Elastic
Description:	Identifies strings used in Cobalt Strike Beacon DLL
Reference:	https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures

Rule name:	HKTL_CobaltStrike_SleepMask_Jul22 Create hunting rule
Author:	CodeX
Description:	Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated
Reference:	https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs

Rule name:	HKTL_Meterpreter_inMemory Create hunting rule
Author:	netbiosX, Florian Roth
Description:	Detects Meterpreter in-memory
Reference:	https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/

Rule name:	HKTL_Win_CobaltStrike Create hunting rule
Author:	threatintel@volexity.com
Description:	The CobaltStrike malware family.
Reference:	https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/

Rule name:	malware_CobaltStrike_v3v4 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect CobaltStrike Beacon in memory
Reference:	https://blogs.jpcert.or.jp/en/2018/08/volatility-plugin-for-detecting-cobalt-strike-beacon.html

Rule name:	MALW_cobaltrike Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Rule to detect CobaltStrike beacon
Reference:	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	pdb_YARAify Create hunting rule
Author:	@wowabiy314
Description:	PDB

Rule name:	ReflectiveLoader Create hunting rule
Author:	Florian Roth
Description:	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:	Internal Research

Rule name:	SUSP_XORed_Mozilla Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	Trojan_Raw_Generic_4 Create hunting rule
Author:	FireEye
Reference:	https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html