MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 daf02e94d294b29896ebfcab021f4184a232617d876f4a8745d10d803a170775. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 4


Intelligence 4 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: daf02e94d294b29896ebfcab021f4184a232617d876f4a8745d10d803a170775
SHA3-384 hash: 0e19367f626d32b79de53a7071b29bb89e93501137bd64688ce888b641982b077ccb2757821f1cdee36daa5a99eb1503
SHA1 hash: 2eb5bfd56e2685543027515766ca91c775dbce9c
MD5 hash: a6fbe4c1e8ef27bec9e5b28a8352cd68
humanhash: yankee-west-oven-fish
File name:0c80423df478d4faab430ac09cadeefe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:128'739 bytes
First seen:2020-11-17 12:04:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4eab418e18a11fb4cddc75e037e7ade5 (4 x CobaltStrike)
ssdeep 3072:DDbisvL0WklxZJ7WD0Ccotu1cHdGCYcF2PkUHxcCXI:XbbvL0WqxZsD0LotuGACpG8CXI
Threatray 1'155 similar samples on MalwareBazaar
TLSH BDC312AF7D057D89E12A32309F4AF19D5D1001B86065E89B9885A75FDE34F48C3CAE36
Reporter seifreed
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.PrivateExeProte-16
Create hunting rule

PUA.Win.Packer.AcprotectUltraprotect-1
Create hunting rule

PUA.Win.Packer.Anti-28
Create hunting rule

PUA.Win.Packer.Anti-29
Create hunting rule

PUA.Win.Packer.Nspack-26
Create hunting rule

PUA.Win.Packer.NPack-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Connection attempt
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/daf02e94d294b29896ebfcab021f4184a232617d876f4a8745d10d803a170775/
Threat name:
Win32.Trojan.Cometer
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 12:06:54 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
1ac354c01e2acdecef6b871f3eee4fe919487b2ca740471fefce8dd3273dde87
CobaltStrike
2d797a098d2c0e164f5bfe29e3ae282f873709270f05950a3dc76d65f1acf47c
CobaltStrike
53f90f56eddfb8953d72e1d20dde2b97d40021318fd32bf30710d24eeb4c4a30
CobaltStrike
58799ca0300fc3d337d339862c0d88519279bb77ed1ebf36634aaf63e7e47cbe
CobaltStrike
7801b75f545c24cf7fba8e98dc4505d21c1a11fd228d04685f714d2a0bef83f0
CobaltStrike
8c5d071dfff8c5ce27afc37e287a64ac273ac70d7bc556efd368616c6cc6386b
CobaltStrike
a9ca1d6a981ccc8d8b144f337c259891a67eb6b85ee41b03699baacf4aae9a78
CobaltStrike
ad42170cf53ef7e0ea91196fedd5f8ae7665e207f9de002c63562f4b1db57717
CobaltStrike
b568a4ca18fce49b465d0db8697640d556f579932db0315398a810140c66f0db
CobaltStrike
d1a71b6a8691f72eb133570b9e90e8de061a652a35e3b4039d0875bbc0f76f1c
CobaltStrike
+ 1'145 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201117-xzaz3jrgce/
Unpacked files
SH256 hash:
daf02e94d294b29896ebfcab021f4184a232617d876f4a8745d10d803a170775
MD5 hash:
a6fbe4c1e8ef27bec9e5b28a8352cd68
SHA1 hash:
2eb5bfd56e2685543027515766ca91c775dbce9c
Link:
https://www.unpac.me/results/875aee27-6b0e-4370-a026-a6e7d86da1fc/
SH256 hash:
6b7956287aa68cabe6cd71a8444a4742d1fce610335aa88722f0f67617ddbd30
MD5 hash:
c39990f2dac1829bf864a358745beae8
SHA1 hash:
b0e2e28e753823fb02c67781589f6a9c9a4fa830
Link:
https://www.unpac.me/results/875aee27-6b0e-4370-a026-a6e7d86da1fc/
SH256 hash:
051823af57f57b1696141acb9ccba7c8cc612e377e1dfd3da088ec52bcd9811b
MD5 hash:
4d8379c372f6f5bc2fd035b01fc2c90e
SHA1 hash:
4987f23c2218bc76dc3001f4b4b210151f682ba1
Link:
https://www.unpac.me/results/875aee27-6b0e-4370-a026-a6e7d86da1fc/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Beacon_K5om
Create hunting rule
Author:Florian Roth
Description:Detects Meterpreter Beacon - file K5om.dll
Reference:https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html
Rule name:CobaltStrikeBeacon
Create hunting rule
Author:enzo
Description:Cobalt Strike Beacon Payload
Rule name:CobaltStrike_Unmodifed_Beacon
Create hunting rule
Author:yara@s3c.za.net
Description:Detects unmodified CobaltStrike beacon DLL
Rule name:crime_win32_csbeacon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Cobalt Strike loader
Reference:https://twitter.com/VK_Intel/status/1239632822358474753
Rule name:HKTL_Meterpreter_inMemory
Create hunting rule
Author:netbiosX, Florian Roth
Description:Detects Meterpreter in-memory
Reference:https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Rule name:INDICATOR_SUSPICIOUS_ReflectiveLoader
Create hunting rule
Author:ditekSHen
Description:detects Reflective DLL injection artifacts
Rule name:Leviathan_CobaltStrike_Sample_1
Create hunting rule
Author:Florian Roth
Description:Detects Cobalt Strike sample from Leviathan report
Reference:https://goo.gl/MZ7dRg
Rule name:Malware_QA_vqgk
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file vqgk.dll
Reference:VT Research QA
Rule name:MALWARE_Win_CobaltStrike
Create hunting rule
Author:ditekshen
Description:CobaltStrike payload
Rule name:PowerShell_Susp_Parameter_Combo
Create hunting rule
Author:Florian Roth
Description:Detects PowerShell invocation with suspicious parameters
Reference:https://goo.gl/uAic1X
Rule name:ReflectiveLoader
Create hunting rule
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:WiltedTulip_ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:http://www.clearskysec.com/tulip

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments