MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 032f8678c49d5320602b75ce8da611d6bc4268354e905aed217451d7f739da67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 032f8678c49d5320602b75ce8da611d6bc4268354e905aed217451d7f739da67
SHA3-384 hash: 2292d240aa6ee1bf46e3b97975928044ca5b79e750217be4c20c6e309975b48485eda7913d32ba52a2aa02013be71331
SHA1 hash: d9896d3d6df30c3d733d145b3e24e3844bbb6751
MD5 hash: 6c63aed2122a6c4a6ab0670501a747c5
humanhash: wisconsin-burger-skylark-nuts
File name:6c63aed2122a6c4a6ab0670501a747c5.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:5'314'560 bytes
First seen:2021-07-19 15:18:36 UTC
Last seen:2021-07-19 15:37:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 30c36f9dc182a09e565e8c4883c61b1a (1 x CobaltStrike)
ssdeep 98304:m5a6SK5TDNoioYhZuL+LFLOAkGkzdnEVomFHKnP:H6xVLxhjLFLOyomFHKnP
Threatray 898 similar samples on MalwareBazaar
TLSH T1F336AEC66BAD00D4C892E075C4A37D07CA76BC9D22E1765F4924F7A62F33362CE1DA25
Reporter abuse_ch
Tags:CobaltStrike exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
501
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6c63aed2122a6c4a6ab0670501a747c5.exe
Verdict:
No threats detected
Analysis date:
2021-07-19 15:20:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5cf85d8d-e1f0-4fc8-a824-e556a6bae16a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/172569/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37220458.9201.10387.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cee38625-f713-44a1-bdd6-9db324cf3bd6
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/818341
Signature
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Sets debug register (to hijack the execution of another thread)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/032f8678c49d5320602b75ce8da611d6bc4268354e905aed217451d7f739da67/
Threat name:
Win64.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2021-06-25 08:43:44 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=amxym6getvjsaybloxhi3jqr226ee2bvj2ifv3jbori5p5zz3jtq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
02efd5f4d8dedabeab8e75f3e49a8fdb05c28dfd39bc1e5c96e8213fe3212e9f
CobaltStrike
18b056a1951f2e7c4ab96095d25e015da4e456493d0591c94584a9063c399025
CobaltStrike
1cf5710e500a423b84b51fa3afdd923fe0a8255c5817d3238175623e2ebbfad9
CobaltStrike
4d71f1eab01045de9ae76ea248be7746bad70c12ad977eeb6e8f8e46bbce6395
CobaltStrike
984265f2a1df743a585b3ed1aa138080dbc0e27c66d2472d10a66c916739556c
CobaltStrike
b820e8a2057112d0ed73bd7995201dbed79a79e13c79d4bdad81a22f12387e07
CobaltStrike
cc74f7e82eb33a14ffdea343a8975d8a81be151ffcb753cb3f3be10242c8a252
CobaltStrike
e99cc027c77bed5c1414225e39093bde66c654a9adfcca9cb3ddafa266410aea
CobaltStrike
ec50240df30bcbc5ece80e6a6702b7230b81e68b712083f01a5780761693c5ae
CobaltStrike
f8c94e76f4d756924bf929b32f85158bc81911ce4a606af67e37460405e0ad3f
CobaltStrike
+ 888 additional samples on MalwareBazaar
Gathering data
Unpacked files
SH256 hash:
032f8678c49d5320602b75ce8da611d6bc4268354e905aed217451d7f739da67
MD5 hash:
6c63aed2122a6c4a6ab0670501a747c5
SHA1 hash:
d9896d3d6df30c3d733d145b3e24e3844bbb6751
Link:
https://www.unpac.me/results/504f29ba-3837-4983-baa4-b0160ead3429/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/032f8678c49d5320602b75ce8da611d6bc4268354e905aed217451d7f739da67

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HKTL_CobaltStrike_Beacon_Strings
Create hunting rule
Author:Elastic
Description:Identifies strings used in Cobalt Strike Beacon DLL
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_Win_CobaltStrike
Create hunting rule
Author:threatintel@volexity.com
Description:The CobaltStrike malware family.
Reference:https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
Rule name:SUSP_XORed_Mozilla
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/172569/

Comments