MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f99eeb308f683edef2e104e3112f3fc1dae8f4b8cfec38200e17b4a2b21691fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f99eeb308f683edef2e104e3112f3fc1dae8f4b8cfec38200e17b4a2b21691fc
SHA3-384 hash: a80829e6e2904890379493e0f99fab5609c7acb1baaa5d7aa0a8032c590079100e53b2d82f211d1c16aaac491a13739b
SHA1 hash: cb62a8577258ada6ced7f6f1036746ca39db7074
MD5 hash: c1bc34d137a4ba2fc966ec82164f70cd
humanhash: robin-don-finch-single
File name:game.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:1'575'936 bytes
First seen:2021-09-04 09:19:50 UTC
Last seen:2021-09-04 10:16:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c7269d59926fa4252270f407e4dab043 (45 x Hive, 23 x ServHelper, 22 x CobaltStrike)
ssdeep 24576:gm6q6hNjhP1KemgSh29pK1xtP/U0mvynTTEMSM:gm6q67VP1ogS29pK1n/0+TnSM
Threatray 19 similar samples on MalwareBazaar
TLSH T171757C477CE054BDD9BAD2318CB592917733B099033227C72F5196B62E72BD42E393A8
Reporter JAMESWT_WT
Tags:1.14.66.81 CobaltStrike exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
644
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
game.exe
Verdict:
No threats detected
Analysis date:
2021-09-04 09:21:59 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6ef5c805-4b4a-4557-b0a0-cc9e039ea219

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/185274/
Detection(s):
SecuriteInfo.com.Trojan.GenericFCA.Agent.13213.14074.31162.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Connection attempt
Sending a UDP request
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4dd30b90-7f2c-4baf-8461-9f729202d2e8
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/845201
Signature
Multi AV Scanner detection for submitted file
Potential time zone aware malware
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f99eeb308f683edef2e104e3112f3fc1dae8f4b8cfec38200e17b4a2b21691fc/
Threat name:
Win64.Trojan.Shelma
Create hunting rule
Status:
Malicious
First seen:
2021-09-04 00:55:39 UTC
File Type:
PE+ (Exe)
AV detection:
18 of 43 (41.86%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
255141a430ed2bbda653b5ab18acdd8dcca5a39cf8c2d1fa938445e31ecf38e5
CobaltStrike
5911ad0a2f2f76cbe6e83b58b95ac820aee88b7fb37e017275bd3984b3b92bfa
CobaltStrike
77207663d42c90aeeb0724391087ebeb2cdb6134ce1fe731ef908c8a961083fe
CobaltStrike
ba15a8b7d1ecc6348ee4806b0903afdf5917a595a909ce529e85cacd197c6e77
CobaltStrike
be9c5e5ce6d4544e6bddbd47c26873fe0c33414086824b1d4968a638184a8a7c
CobaltStrike
f7a805b251505433e34517da69eccb73955a424bb9d9061309091cf52c07a349
CobaltStrike
+ 9 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike backdoor trojan
Link:
https://tria.ge/reports/210904-las8yahcbp/
Behaviour
Cobaltstrike
Malware Config
C2 Extraction:
http://1.14.66.81:6432/BtdC
Unpacked files
SH256 hash:
f99eeb308f683edef2e104e3112f3fc1dae8f4b8cfec38200e17b4a2b21691fc
MD5 hash:
c1bc34d137a4ba2fc966ec82164f70cd
SHA1 hash:
cb62a8577258ada6ced7f6f1036746ca39db7074
Link:
https://www.unpac.me/results/7418e5f8-ecf3-4cbe-a484-e99501570444/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/f99eeb308f683edef2e104e3112f3fc1dae8f4b8cfec38200e17b4a2b21691fc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:GoBinTest
Create hunting rule
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:golang
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/185274/

Comments