MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b620e1d6736e5951a319a1af7e17d77f46929d200532dbee0d41b15f4318fc7d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 13


Intelligence 13 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b620e1d6736e5951a319a1af7e17d77f46929d200532dbee0d41b15f4318fc7d
SHA3-384 hash: a8bdef51f8261e1a8490db70acd537a0628e38070472b2748545f44e4f9fa0baa3b7df02dec3949edd52f79dd25d4850
SHA1 hash: d308cc32317c3caacaf9305bd7569f55561a8582
MD5 hash: 03670fc52aa24fa82d2fdf0178b3d76f
humanhash: purple-lake-johnny-leopard
File name:03670fc52aa24fa82d2fdf0178b3d76f.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:225'792 bytes
First seen:2021-08-05 05:46:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 829da329ce140d873b4a8bde2cbfaa7e (259 x CobaltStrike)
ssdeep 3072:Lty6NsDIS+V7ZDIMugN/HsdI6mwTk1Z02rdS74ljurtFat03xLVhOdnJK/wJ0E:oLDl8lIE/KTk1vljoFat03dWJe9E
TLSH T1B324DFB9D8E19CCFF7868771C5A57EF26C618283CC47A19BF840BF34156242E6A20D9D
Reporter abuse_ch
Tags:CobaltStrike exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
505
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cobaltstrike_shellcode.exe
Verdict:
Malicious activity
Analysis date:
2021-08-01 14:08:39 UTC
Tags:
trojan
Link:
https://app.any.run/tasks/2ccb6fb3-6fc4-4ea6-89fe-385e1df9b4cd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/176514/
Detection(s):
SecuriteInfo.com.Crypt5.BLLV.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/751d40af-1733-4d5d-bbf7-cf038784afc7
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/827881
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
cobaltstrike
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b620e1d6736e5951a319a1af7e17d77f46929d200532dbee0d41b15f4318fc7d/
Threat name:
Win32.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2021-08-01 20:19:32 UTC
AV detection:
40 of 46 (86.96%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wyqodvttnzmvdiyzugxx4f6xp5djfhjaauznx3qnigyv6qyy7r6q._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:1891653558 backdoor suricata trojan
Link:
https://tria.ge/reports/210805-gbgmfkam92/
Behaviour
Cobaltstrike
suricata: ET MALWARE Cobalt Strike Malleable C2 (Unknown Profile)
suricata: ET MALWARE Observed Malicious SSL Cert (Fake Gmail Self Signed - Possible Cobalt Stirke)
Malware Config
C2 Extraction:
http://r.wlthplum.com:443/_/scs/mail-static/_/js/
Unpacked files
SH256 hash:
8cf66afc22e48ec4a65d908487d410c6fe2e9976c053d6da8316e4d510d5c4ba
MD5 hash:
5f0c312b582824529db6cac555a7c898
SHA1 hash:
9324956a3431d564e9dd356903785e427cd46a0a
Link:
https://www.unpac.me/results/01d5ba9a-8cc3-4548-8400-128bcfb98bc2/
SH256 hash:
03c6b9b0492380eec5874000588fb48c8984e0626d2a31a010f738e77f0231b1
MD5 hash:
6e08ec889a6710a1b76b7e32087f8e15
SHA1 hash:
4be0e1fb3792a5990adc557b3b16d60a073cb8f7
Link:
https://www.unpac.me/results/01d5ba9a-8cc3-4548-8400-128bcfb98bc2/
SH256 hash:
b620e1d6736e5951a319a1af7e17d77f46929d200532dbee0d41b15f4318fc7d
MD5 hash:
03670fc52aa24fa82d2fdf0178b3d76f
SHA1 hash:
d308cc32317c3caacaf9305bd7569f55561a8582
Link:
https://www.unpac.me/results/01d5ba9a-8cc3-4548-8400-128bcfb98bc2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b620e1d6736e5951a319a1af7e17d77f46929d200532dbee0d41b15f4318fc7d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobaltbaltstrike_strike_Payload_XORed
Create hunting rule
Author:Avast Threat Intel Team
Description:Detects CobaltStrike payloads
Reference:https://github.com/avast/ioc
Rule name:CobaltStrike_Unmodifed_Beacon
Create hunting rule
Author:yara@s3c.za.net
Description:Detects unmodified CobaltStrike beacon DLL
Rule name:crime_win32_csbeacon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Cobalt Strike loader
Reference:https://twitter.com/VK_Intel/status/1239632822358474753
Rule name:CS_beacon
Create hunting rule
Author:Etienne Maynier tek@randhome.io
Rule name:HKTL_CobaltStrike_Beacon_4_2_Decrypt
Create hunting rule
Author:Elastic
Description:Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_CobaltStrike_Beacon_Strings
Create hunting rule
Author:Elastic
Description:Identifies strings used in Cobalt Strike Beacon DLL
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_Meterpreter_inMemory
Create hunting rule
Author:netbiosX, Florian Roth
Description:Detects Meterpreter in-memory
Reference:https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Rule name:HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5
Create hunting rule
Author:Florian Roth
Description:Detects strings found in CobaltStrike shellcode
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Rule name:HKTL_Win_CobaltStrike
Create hunting rule
Author:threatintel@volexity.com
Description:The CobaltStrike malware family.
Reference:https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
Rule name:INDICATOR_SUSPICIOUS_ReflectiveLoader
Create hunting rule
Author:ditekSHen
Description:detects Reflective DLL injection artifacts
Rule name:ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:WiltedTulip_ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:http://www.clearskysec.com/tulip

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/176514/

Comments