MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe484a6556303f87a453fe263cc98ad79e3265e17d7052680f427536d7d52e2b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CobaltStrike

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	fe484a6556303f87a453fe263cc98ad79e3265e17d7052680f427536d7d52e2b
SHA3-384 hash:	54397963decd74095f0783754d5c2ecf6f78544d1a21a282ab15d5e0207530a394176b6c83522269d8862dd1fa65cd47
SHA1 hash:	f737f1506ad2777467a7bea4fef94a6bfc9df1fc
MD5 hash:	65856250d2d1d5b1c572d1bd858e3cbf
humanhash:	five-may-carbon-arkansas
File name:	IRS_form_5763.xls
Download:	download sample
Signature	CobaltStrike Create hunting rule
File size:	399'365 bytes
First seen:	2020-07-24 15:24:28 UTC
Last seen:	Never
File type:	xls
MIME type:	application/vnd.ms-excel
ssdeep	6144:Vk3hOdsylKlgryzc4bNhZF+E+W2knAVtCPFbj5vYnszR9a6VSHfw46Y3vom5CTO8:BtCdbdQnsH7Q/wbAvomQCCeYP+zgRB8I
TLSH	1D8438D4F669C62AC6A7CABD5E0F42F25729FC01922A43C712C4B53C3E797789D8A0C5
Reporter	abuse_ch
Tags:	CobaltStrike geo GoDaddy IRS USA xls

abuse_ch

Malspam distributing CobaltStrike:

HELO: p3plsmtpout002.prod.phx3.secureserver.net
Sending IP: 208.109.80.52
From: admin@modernvaseandgift.com
Subject: IRS_form you asked
Attachment: IRS_form_5763.xls

CobaltStrike payload URL:
http://104.161.32.119/xX0jD3dXqi.php
http://185.81.98.78/64.exe

CobaltStrike C2s:
managemen.onlinestephanie.xyz
authoritative.rogerwlaker.xyz
cloudflare.robertstratton.xyz

Intelligence

File Origin

# of uploads :

# of downloads :

126

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

TwinWave.EvilDoc.Excel4ConCatsAM1984_T_800.20200623.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching the default Windows debugger (dwwin.exe)

Launching a process by exploiting the app vulnerability

Result

Threat name:

Hidden Macro 4.0

Detection:

malicious

Classification:

evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/397522

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fe484a6556303f87a453fe263cc98ad79e3265e17d7052680f427536d7d52e2b/

Threat name:

Document-Word.Downloader.EncDoc

Status:

Malicious

First seen:

2020-07-24 15:26:07 UTC

AV detection:

13 of 48 (27.08%)

Threat level:

3/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7zeeuzkwga7ypjct7ytdzsmk26pdezpbpvyfe2apij2tnv6vfyvq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

macro

Link:

https://tria.ge/reports/200724-hh65t9j8ya/

Behaviour

Suspicious Office macro

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fe484a6556303f87a453fe263cc98ad79e3265e17d7052680f427536d7d52e2b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.