MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ecf5a2c06c78f79bc20180e1be1c9e41487b5789b1af712ebb7ed6091486536. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ecf5a2c06c78f79bc20180e1be1c9e41487b5789b1af712ebb7ed6091486536
SHA3-384 hash: deb18d905517ac4d5a375fb7f3a3cba0b3fb1daa297c1f3ade299917c1e2d2452c64926a3bcd72845e18331ffaa12156
SHA1 hash: f420b7955826a8dce76b8cb5f955280cb1c66dcc
MD5 hash: c0eb056f4ece858a9b71352865247d1b
humanhash: magnesium-high-edward-hawaii
File name:0ecf5a2c06c78f79bc20180e1be1c9e41487b5789b1af712ebb7ed6091486536
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:32'728 bytes
First seen:2021-08-03 08:31:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash dd92932e021c9b9f238b2bd809b4c945 (2 x CobaltStrike)
ssdeep 768:P8G0CRfT0+4C93QdSf6k/MPZime8h55Yi6sIIkTiPLu:0G0CJYHMgdSXMxCu76sIISiPLu
Threatray 1'060 similar samples on MalwareBazaar
TLSH T1B0E27B8B52240C72DD2BC979DFC5861AEEB5F8805AF0C39E032981A51F13361F1BD728
Reporter JAMESWT_WT
Tags:CobaltStrike exe signed StackUp ApS

Code Signing Certificate

Organisation:StackUp ApS
Issuer:DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:sha256WithRSAEncryption
Valid from:2021-07-16T00:00:00Z
Valid to:2022-07-19T23:59:59Z
Serial number: 0400c7614f86d75fe4ee3f6192b6feda
Intelligence: 12 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: 64cd94f7ed9b7ba8f7d58445c0b9d9823d37782cc3500d359b86c4a3b091d5b8
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
493
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0ecf5a2c06c78f79bc20180e1be1c9e41487b5789b1af712ebb7ed6091486536
Verdict:
No threats detected
Analysis date:
2021-08-03 08:34:21 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f94d6c06-b665-4c44-9b31-77c21e55fa78

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/175971/
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
BazarLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c0086194-fcf9-4e57-8778-33d7eae6f7c3
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/825977
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ecf5a2c06c78f79bc20180e1be1c9e41487b5789b1af712ebb7ed6091486536/
Threat name:
Win64.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2021-08-02 11:46:31 UTC
File Type:
PE+ (Exe)
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b3hvulagy6hxtpbadahbxyoj4qkipnlytmnpoexlw7wwbekimu3a._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
1b11ae98b85bb0645abe36adcd852e6e84b51c6b5c811729f3c19f14f32d4e4f
CobaltStrike
2bfe11c06ffe157399432080f6de6190e1062c99b4a55ec31974b5a37ee8dd3c
CobaltStrike
42104ac31fe7ae7328c209007ea71dc3effb183c736a9bddcf86f690fe96df9a
CobaltStrike
954944ef6cdd1474ed35f27b790a7914156672cc7a1afbcc3214ccc1855ff12e
CobaltStrike
971c693bc67cf7b4b9655282b815bc1ba10ee937f1736ba1ef5fdb7aea392f6c
CobaltStrike
9ca6449c0586a77c55586bcc7adfaef2c3cc53da4713c5ed57fced15a3054545
CobaltStrike
bb4efe96748fcc28b827fc297d060c3ab32053cfb8ea506f8c97000debd22121
CobaltStrike
d1d0c9d1ee7b800d491c9fb3fc94b93e5c59d903a4debb092846c46481077ae0
CobaltStrike
e8d4bf2dc68074adf01dc003d51de3842994ae07fa88c370e8d29f1c27d9c407
CobaltStrike
+ 1'050 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:0 backdoor suricata trojan
Link:
https://tria.ge/reports/210803-nm3rrc3gz6/
Behaviour
Modifies system certificate store
Cobaltstrike
suricata: ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M3
suricata: ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response
Malware Config
C2 Extraction:
http://fondfbr.com:443/jquery-3.3.1.min.js
Unpacked files
SH256 hash:
0ecf5a2c06c78f79bc20180e1be1c9e41487b5789b1af712ebb7ed6091486536
MD5 hash:
c0eb056f4ece858a9b71352865247d1b
SHA1 hash:
f420b7955826a8dce76b8cb5f955280cb1c66dcc
Link:
https://www.unpac.me/results/e1442951-8d95-45f5-9222-4b693f2d0290/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0ecf5a2c06c78f79bc20180e1be1c9e41487b5789b1af712ebb7ed6091486536

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/175971/

Comments