MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e59cc3a94f6a5119f36c4e0b3fbe6f04cc474d0b0b9d101163dac75722c809da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e59cc3a94f6a5119f36c4e0b3fbe6f04cc474d0b0b9d101163dac75722c809da
SHA3-384 hash: dd0fa1d07855712f7b893337c84a5967e9814475dce646111afac5f81e49f48be9732e1c16a255ca9d36c90d99e66578
SHA1 hash: 61aae466904ce3009d5747a68e24761ffebd6a37
MD5 hash: 7d05de0210deb32c121bb34fd6e19a15
humanhash: low-december-harry-bacon
File name:e59cc3a94f6a5119f36c4e0b3fbe6f04cc474d0b0b9d101163dac75722c809da
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:288'256 bytes
First seen:2021-07-02 11:14:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 17b461a082950fc6332228572138b80c (121 x CobaltStrike, 2 x Cobalt Strike)
ssdeep 6144:PCcg6grIhZEtvvGyXrtfwIpmQSpf39HBAaLkRxLgjMnGU:G6stkLHBAaLK
TLSH 10547B14F9EE0B2CC7055A77DB52B3B0109E4C844918E4FEBB674ECB50B45E989B2F26
Reporter JAMESWT_WT
Tags:CobaltStrike exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
192
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e59cc3a94f6a5119f36c4e0b3fbe6f04cc474d0b0b9d101163dac75722c809da
Verdict:
No threats detected
Analysis date:
2021-07-02 11:15:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/957ea4ac-cc56-490c-acf0-b79a56dba1e9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/169331/
Detection(s):
Win.Trojan.CobaltStrike-9044898-1
Create hunting rule

Win.Trojan.CobaltStrike-7899871-1
Create hunting rule

Win.Countermeasure.LoaderWinGeneric-9804845-2
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1565d991-e974-414e-8217-03e33f71deef
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/811041
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
cobaltstrike
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e59cc3a94f6a5119f36c4e0b3fbe6f04cc474d0b0b9d101163dac75722c809da/
Threat name:
Win64.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2021-06-26 03:52:59 UTC
File Type:
PE+ (Exe)
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:2093439450 backdoor trojan
Link:
https://tria.ge/reports/210702-jtbyalr8wa/
Behaviour
Modifies system certificate store
Cobaltstrike
Malware Config
C2 Extraction:
http://us-traffic-azure.azureedge.net:443/amsterdam/delete.asp
Unpacked files
SH256 hash:
e59cc3a94f6a5119f36c4e0b3fbe6f04cc474d0b0b9d101163dac75722c809da
MD5 hash:
7d05de0210deb32c121bb34fd6e19a15
SHA1 hash:
61aae466904ce3009d5747a68e24761ffebd6a37
Link:
https://www.unpac.me/results/7635a6f7-7997-4168-8f29-4036108224a6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
CobaltStrike
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e59cc3a94f6a5119f36c4e0b3fbe6f04cc474d0b0b9d101163dac75722c809da

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HKTL_CobaltStrike_Beacon_4_2_Decrypt
Create hunting rule
Author:Elastic
Description:Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_CobaltStrike_Beacon_Strings
Create hunting rule
Author:Elastic
Description:Identifies strings used in Cobalt Strike Beacon DLL
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_Win_CobaltStrike
Create hunting rule
Author:threatintel@volexity.com
Description:The CobaltStrike malware family.
Reference:https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/malwrhunterteam/status/1410917633059348484?s=20
Cape
Cape
https://www.capesandbox.com/analysis/169331/

Comments