MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e65e6051980701ae9bcd600fd08c7be44f8f299c8ad68d8cbddf704f9757c870. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e65e6051980701ae9bcd600fd08c7be44f8f299c8ad68d8cbddf704f9757c870
SHA3-384 hash: e297c0299436f400f9c96f95fb4feab64541699633c12f38631f74090c0a19ee31fced9097ef36e58712d5f65785f597
SHA1 hash: 03bceec136964f101f5f98ce07da9e1a566865e3
MD5 hash: c7058945ae7fe85fec4d60cc551cac24
humanhash: river-wyoming-cola-charlie
File name:lsass.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:18'944 bytes
First seen:2022-07-16 15:00:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7d68a9be287b7923792fc63f65e9343a (3 x CobaltStrike)
ssdeep 192:e0X9M+VvDVyaLjIy/hZFLKHGGfet4Wv/6Sbz2IpqqDF7FR1DMjjhh:1HVJyawy/h7KIvhhvDZh+hh
TLSH T13982D61BA31348FCC916D6B485FB6B32B8B23D5146A1473E337CD6F51F216A02D9EA11
TrID 43.3% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
27.5% (.EXE) Win64 Executable (generic) (10523/12/4)
13.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.3% (.EXE) OS/2 Executable (generic) (2029/13)
5.2% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter r3dbU7z
Tags:CobaltStrike exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
808
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/291232/
Detection(s):
Win.Countermeasure.LoaderWinGeneric-9804845-2
Create hunting rule

Win.Malware.Agent-9870952-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending an HTTP GET request
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/26366/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionGetTickCount
EvasionQueryPerformanceCounter
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5833811b-ba3a-45fd-877b-9eb045899b34
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1033849
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e65e6051980701ae9bcd600fd08c7be44f8f299c8ad68d8cbddf704f9757c870/
Threat name:
Win64.Backdoor.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2022-07-16 15:01:06 UTC
File Type:
PE+ (Exe)
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4zpgaumya4a25g6nmah5bdd34rhy6km4rlli3df535ye7f2xzbya._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:0 backdoor suricata trojan
Link:
https://tria.ge/reports/220716-sdbxdsdchm/
Behaviour
Cobaltstrike
suricata: ET MALWARE Cobalt Strike Beacon Observed
suricata: ET MALWARE Successful Cobalt Strike Shellcode Download (x64) M1
Unpacked files
SH256 hash:
e65e6051980701ae9bcd600fd08c7be44f8f299c8ad68d8cbddf704f9757c870
MD5 hash:
c7058945ae7fe85fec4d60cc551cac24
SHA1 hash:
03bceec136964f101f5f98ce07da9e1a566865e3
Link:
https://www.unpac.me/results/e10f3ec5-783b-411b-82e1-81d0ce7a50df/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e65e6051980701ae9bcd600fd08c7be44f8f299c8ad68d8cbddf704f9757c870

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Trojan_Win_Generic_101
Create hunting rule
Author:FireEye
Description:Detects FireEye Windows trojan
Reference:https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CobaltStrike

Executable exe e65e6051980701ae9bcd600fd08c7be44f8f299c8ad68d8cbddf704f9757c870

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/291232/

Comments