MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c19335daa94f85852468d5dad1fb9cf93bf121aee3eac8203180d88479965d94. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 13


Intelligence 13 IOCs YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c19335daa94f85852468d5dad1fb9cf93bf121aee3eac8203180d88479965d94
SHA3-384 hash: a89f003c1bc88e262c3c4e069d9f81baf40a2ca430142ce6d26e12f1d0779372c23209334b3733a98c93c5a245b90e76
SHA1 hash: a09cf1757fa3950d3993c16c77aa0c3c8bbd3a76
MD5 hash: 02c0e2a639f591f93c75f9a698355354
humanhash: hawaii-aspen-one-snake
File name:Bf9hQ7OzM211i
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:324'264 bytes
First seen:2021-06-21 22:40:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 438bece8c96b99d017141b3f95b86408 (16 x CobaltStrike)
ssdeep 6144:t1YlNk2GVPYzoBEuC8Wr9hrqc5FDlD6PX055trNL4:rYlNRmFJC8y9hrqGdVt5rrK
Threatray 304 similar samples on MalwareBazaar
TLSH D764C14DCA8B417687FED3BC106DB97BC80A0A1DA9F736D537B29461D69070B1CEB209
Reporter bigmacjpg
Tags:CobaltStrike exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
482
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Bf9hQ7OzM211i
Verdict:
Malicious activity
Analysis date:
2021-06-21 22:45:14 UTC
Tags:
trojan cobaltstrike
Link:
https://app.any.run/tasks/4dff985e-98ee-4106-ab2e-9c5f64cc0ed4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrike
Create hunting rule
Link:
https://www.capesandbox.com/analysis/167397/
Detection(s):
SecuriteInfo.com.Mal.EncPk-APV.24571.4502.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9867a49e-1856-465d-9695-89f8ab6094f6
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/805645
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Yara detected CobaltStrike
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
Detection:
cobaltstrike
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c19335daa94f85852468d5dad1fb9cf93bf121aee3eac8203180d88479965d94/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-06-21 22:41:08 UTC
AV detection:
17 of 46 (36.96%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ygjtlwvjj6cykjdi2xnnd6447e57cino4pvmqibrqdmii6mwlwka._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
0addfafe0e5f26952199b892cd6e822800e25cde1c6738fef6aac32d01d42704
CobaltStrike
0ce6ad36ff912286baa98105cbccab3457b2b0fda0796b51f898b695146c4022
CobaltStrike
2231fe26243e074c03019cb2e2a4f25c0ef60bc9e82022f3e88fc77c4bf18102
CobaltStrike
293b8738ec85a19d31ba1abf99c9922ab2868986cf1042fe0a1f623a9f8dcd07
CobaltStrike
5b11998f63458e0c8f86b101bfa4c08d4d523417dd4763c65712b73e5258d434
CobaltStrike
b35d8aaa8d0fc82e71782c157ec1f7ba87df914536e7d2e6d5d7ec7a36122933
CobaltStrike
c4c0bee389392c0677fd977cac9eaa868448c42d8b90281872cdf5b804e0525c
CobaltStrike
cc9a713b0db799bb4be1d74f9ef2d043985218e94d5004e5c42a4996dfb33131
CobaltStrike
cd4333533191a81dfd34340d44fa234ab01dffba24c47f6f733e05bef15c9eee
CobaltStrike
d764ee64bc0d769c20c4823f0981ba1bf17e46c38812cd5036f0e2cfadb23b61
CobaltStrike
+ 294 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:1359593325 backdoor cryptone packer trojan
Link:
https://tria.ge/reports/210621-xrxnydjvm2/
Behaviour
Cobaltstrike
Malware Config
C2 Extraction:
http://5.39.222.84:80/cx
Unpacked files
SH256 hash:
a70a2827dabb9bf888789bda532219916348def08e3dec4c71d1b8f601fe87b5
MD5 hash:
b52926d6c9aefa4e00ac9f64b273a358
SHA1 hash:
24673355276e796b6c2a8ef66a4151f022a4c9cb
Detections:
win_cobalt_strike_auto
Create hunting rule
Link:
https://www.unpac.me/results/2e98b142-da02-4d02-ab89-290aba863a32/
Parent samples :
0ce6ad36ff912286baa98105cbccab3457b2b0fda0796b51f898b695146c4022
5b11998f63458e0c8f86b101bfa4c08d4d523417dd4763c65712b73e5258d434
d764ee64bc0d769c20c4823f0981ba1bf17e46c38812cd5036f0e2cfadb23b61
0addfafe0e5f26952199b892cd6e822800e25cde1c6738fef6aac32d01d42704
c4c0bee389392c0677fd977cac9eaa868448c42d8b90281872cdf5b804e0525c
c19335daa94f85852468d5dad1fb9cf93bf121aee3eac8203180d88479965d94
d859175475c077d7193ce0f1ee703ee4be5dd0804c45da6cbd447b7909c9a09f
b6868bf6126b8450e2863450959b4d8889d96e10e0f472de0d7269b3c8eff4e3
37a88c00460beed5e1ba3ff00493934c8f8fb0e692b368691d3856454a905073
SH256 hash:
4da8d8a6ca67c45f5a93145f001e5fd7e8e4d835c7ab97c35f80808db7411058
MD5 hash:
6d6ea04ee07f7424054a80acb6881094
SHA1 hash:
af74c23228cded507087a0ccd5da7ae0889d356a
Link:
https://www.unpac.me/results/2e98b142-da02-4d02-ab89-290aba863a32/
SH256 hash:
c19335daa94f85852468d5dad1fb9cf93bf121aee3eac8203180d88479965d94
MD5 hash:
02c0e2a639f591f93c75f9a698355354
SHA1 hash:
a09cf1757fa3950d3993c16c77aa0c3c8bbd3a76
Link:
https://www.unpac.me/results/2e98b142-da02-4d02-ab89-290aba863a32/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c19335daa94f85852468d5dad1fb9cf93bf121aee3eac8203180d88479965d94

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Beacon_K5om
Create hunting rule
Author:Florian Roth
Description:Detects Meterpreter Beacon - file K5om.dll
Reference:https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html
Rule name:CobaltStrikeBeacon
Create hunting rule
Author:enzo
Description:Cobalt Strike Beacon Payload
Rule name:CobaltStrike_Unmodifed_Beacon
Create hunting rule
Author:yara@s3c.za.net
Description:Detects unmodified CobaltStrike beacon DLL
Rule name:crime_win32_csbeacon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Cobalt Strike loader
Reference:https://twitter.com/VK_Intel/status/1239632822358474753
Rule name:CS_beacon
Create hunting rule
Author:Etienne Maynier tek@randhome.io
Rule name:HKTL_CobaltStrike_Beacon_4_2_Decrypt
Create hunting rule
Author:Elastic
Description:Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_CobaltStrike_Beacon_Strings
Create hunting rule
Author:Elastic
Description:Identifies strings used in Cobalt Strike Beacon DLL
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_Meterpreter_inMemory
Create hunting rule
Author:netbiosX, Florian Roth
Description:Detects Meterpreter in-memory
Reference:https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Rule name:HKTL_Win_CobaltStrike
Create hunting rule
Author:threatintel@volexity.com
Description:The CobaltStrike malware family.
Reference:https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
Rule name:INDICATOR_SUSPICIOUS_ReflectiveLoader
Create hunting rule
Author:ditekSHen
Description:detects Reflective DLL injection artifacts
Rule name:Leviathan_CobaltStrike_Sample_1
Create hunting rule
Author:Florian Roth
Description:Detects Cobalt Strike sample from Leviathan report
Reference:https://goo.gl/MZ7dRg
Rule name:Malware_QA_vqgk
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file vqgk.dll
Reference:VT Research QA
Rule name:MALWARE_Win_CobaltStrike
Create hunting rule
Author:ditekSHen
Description:CobaltStrike payload
Rule name:PowerShell_Susp_Parameter_Combo
Create hunting rule
Author:Florian Roth
Description:Detects PowerShell invocation with suspicious parameters
Reference:https://goo.gl/uAic1X
Rule name:ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:SUSP_XORed_Mozilla
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:Trojan_Win_Generic_101
Create hunting rule
Author:FireEye
Description:Detects FireEye Windows trojan
Reference:https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html
Rule name:WiltedTulip_ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:http://www.clearskysec.com/tulip
Rule name:win_cobalt_strike_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CobaltStrike

Executable exe c19335daa94f85852468d5dad1fb9cf93bf121aee3eac8203180d88479965d94

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/167397/

Comments