MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 051243b7e0082007493c576d3b896cbf3eeec3cf9572ee669ee0f4d7dca0570d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
CobaltStrike
Vendor detections: 9
| SHA256 hash: | 051243b7e0082007493c576d3b896cbf3eeec3cf9572ee669ee0f4d7dca0570d |
|---|---|
| SHA3-384 hash: | f58a13fb8b7b8baafcaaa17e80e192de99040a0270b8c5d38eed3e527e84c073f425e861e5bc223b761668e7ffb05fbf |
| SHA1 hash: | 7f885b74a03bafc5a8349837d140214f75023d78 |
| MD5 hash: | ab75f4edb052dbb0ec99f5f8308c8202 |
| humanhash: | connecticut-cup-princess-lithium |
| File name: | 051243b7e0082007493c576d3b896cbf3eeec3cf9572ee669ee0f4d7dca0570d.bin |
| Download: | download sample |
| Signature | CobaltStrike |
| File size: | 7'481'949 bytes |
| First seen: | 2021-07-28 10:05:54 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat) |
| ssdeep | 196608:BAnCVyaEDb+C6OIVnctApt4X/dNT7J8EkuY+IfpzOj8XB01:uCVn6yCZIGSjENXJQBtt+8XBu |
| Threatray | 781 similar samples on MalwareBazaar |
| TLSH | T11F76332FB9C14175D930F437AA29F371513AAD624E48CA5FF3C0FA6AF835050A61EB91 |
| dhash icon | 62acb834f4983c32 (1 x CobaltStrike) |
| Reporter |  JAMESWT_WT |
| Tags: | CobaltStrike exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
501
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
051243b7e0082007493c576d3b896cbf3eeec3cf9572ee669ee0f4d7dca0570d.bin
Verdict:
Malicious activity
Analysis date:
2021-07-28 10:08:17 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Signature
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Behaviour
Behavior Graph:
Gathering data
Threat name:
Win32.Trojan.NimzLoader
Status:
Malicious
First seen:
2021-07-25 01:06:36 UTC
File Type:
PE (Exe)
Extracted files:
61
AV detection:
25 of 46 (54.35%)
Threat level:
5/5
Verdict:
malicious
Label(s):
cobaltstrike
Similar samples:
+ 771 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Score:
10/10
Tags:
family:cobaltstrike backdoor trojan
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Executes dropped EXE
Cobaltstrike
Malware Config
C2 Extraction:
http://8.136.4.131:6666/NsLP
Unpacked files
SH256 hash:
25fcb92356edd1d9dd5a1052a17756afa655258b2a7603994f7d0212057bc8bb
MD5 hash:
ec1cd149d3c1af93cd1a268a7634f580
SHA1 hash:
c6dda9414593536eb902b34af67c94554033cc2d
SH256 hash:
4da1830708b80539cb6ef7893ccd60ac731ca1e159495cac8fd6d6baa0e06e5c
MD5 hash:
fff59f620f89e1db1a55a67c02d7cd82
SHA1 hash:
93363f117557a3b74bad23280f1849d539739ecc
SH256 hash:
051243b7e0082007493c576d3b896cbf3eeec3cf9572ee669ee0f4d7dca0570d
MD5 hash:
ab75f4edb052dbb0ec99f5f8308c8202
SHA1 hash:
7f885b74a03bafc5a8349837d140214f75023d78
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.