MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16fbf35ccfa2ba2d6954c266d18f7b62a8ccc72d83a8a79c3ad810ea68e4aa93. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CobaltStrike

Vendor detections: 15

Intelligence 15 IOCs YARA 52 File information Comments

SHA256 hash:	16fbf35ccfa2ba2d6954c266d18f7b62a8ccc72d83a8a79c3ad810ea68e4aa93
SHA3-384 hash:	ead06e3e871292467d9e3e1fc8c7aa9a2008a6f05df6ebe5125999bb6ac1dd12c2a56a535a70c5972cf8cff85ee9102f
SHA1 hash:	aed115066979e6abebad02f7087f0b50c27963c9
MD5 hash:	64397899c5cd141e6c5da7aab56f0f42
humanhash:	red-thirteen-north-pasta
File name:	p86.exe
Download:	download sample
Signature	CobaltStrike Create hunting rule
File size:	2'423'296 bytes
First seen:	2024-05-09 19:46:31 UTC
Last seen:	2024-05-09 20:25:12 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	94f69b864f86c56c1c27a0b4a51494e6 (1 x CobaltStrike)
ssdeep	49152:7lh/6RSrfo3kS9DpvJ4g4REgBCUp6YnUAQJ8GqGGR6MTX1d:7f6Uw0SdpvJx4REiCUp6YnUAQVYhTX1d
Threatray	14 similar samples on MalwareBazaar
TLSH	T19FB58E313AB0C46AD1931F32AA49B73934BDF6380676E1AF57850E285DB49435E18FE3
TrID	50.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 27.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 9.1% (.EXE) Win64 Executable (generic) (10523/12/4) 4.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 3.9% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter	Anonymous
Tags:	CobaltStrike exe

Intelligence

File Origin

# of uploads :

# of downloads :

343

Origin country :

Vendor Threat Intelligence

Malware family:

cobaltstrike

ID:

File name:

p86.exe

Verdict:

Malicious activity

Analysis date:

2024-05-08 19:03:00 UTC

Tags:

cobaltstrike

Link:

https://app.any.run/tasks/f7ce848b-6725-48b2-bd4b-7cdcaea3e0c4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.Malware-gen.4021.29947.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

fingerprint iceid keylogger lolbin packed risepro shell32

Link:

https://www.filescan.io/uploads/663d283611114a9ab5e5e6b4/reports/5f72eba0-35a8-422b-ab65-ba828a16d92c/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/16fbf35ccfa2ba2d6954c266d18f7b62a8ccc72d83a8a79c3ad810ea68e4aa93

Malware family:

Cobalt Strike

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8cd5801e-f573-4bf8-a0ed-e18de4dd4c0b

Result

Threat name:

CobaltStrike, ReflectiveLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1439142

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Found potential dummy code loops (likely to delay analysis)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Sigma detected: Suspicious Outbound Kerberos Connection

Yara detected CobaltStrike

Yara detected Powershell download and execute

Yara detected ReflectiveLoader

Behaviour

Behavior Graph:

Download SVG

Score:

59%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/16fbf35ccfa2ba2d6954c266d18f7b62a8ccc72d83a8a79c3ad810ea68e4aa93

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/16fbf35ccfa2ba2d6954c266d18f7b62a8ccc72d83a8a79c3ad810ea68e4aa93/

Threat name:

Win32.Backdoor.CobaltStrikeBeacon

Status:

Malicious

First seen:

2024-05-08 20:26:12 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=c357gxgpuk5c22kuyjtndd33mkumzrznqoukphb23aiou2hevkjq._file

Verdict:

malicious

Label(s):

cobaltstrike

CobaltStrike

9efe830686c8849fdd7bb62ebce4ff3659788c6b48b636040443009c02fd0d71

CobaltStrike

9f8c457038dec8b3ce15996b078008bd5ec3d817b969da6bce8c6902a513d225

CobaltStrike

ae62ac2596c41db7d18fcfce29955d6b420a5783c0f27ca8d667caab3ec16398

CobaltStrike

b85e1e79b143c308a707b86b827dd4bacc0d2240a260cf97c3a944f96c96083f

CobaltStrike

d8b2d883d3b376833fa8e2093e82d0a118ba13b01a2054f8447f57d9fec67030

CobaltStrike

+ 4 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/240509-yhhhmaed94/

Unpacked files

SH256 hash:

d3409fcfb7846a3f081d8f8d6b2e7de81a3be149521d135c2077d1f8c8dd78f7

MD5 hash:

f7dec8b064752908cf10940535662431

SHA1 hash:

283babf4a99cf33a96357781161adab5d4a577b6

Detections:

cobaltstrike_xor_config

win_cobalt_strike_auto

CS_beacon

HKTL_Win_CobaltStrike

INDICATOR_SUSPICIOUS_ReflectiveLoader

ReflectiveLoader

HKTL_Meterpreter_inMemory

Malware_QA_vqgk

WiltedTulip_ReflectiveLoader

CobaltStrike_Sleeve_BeaconLoader_x86_o_v4_3_v4_4_v4_5_and_v4_6

Leviathan_CobaltStrike_Sample_1

Beacon_K5om

PowerShell_Susp_Parameter_Combo

CobaltStrike_C2_Encoded_XOR_Config_Indicator

CobaltStrike_Sleeve_BeaconLoader_x86_o_v4_3_v4_4_v4_5_and_v4_6

HKTL_CobaltStrike_Beacon_Strings

hacktool_windows_cobaltstrike_beacon

MALWARE_Win_CobaltStrike

CobaltStrike_Unmodifed_Beacon

SUSP_XORed_Mozilla

Link:

https://www.unpac.me/results/cf26b668-075f-4443-80a0-e65b13fe5b59/

SH256 hash:

02906478464f0a358a5ffe8a5ecea7742b7a7ce706669939d4c9cc0ced797c9f

MD5 hash:

713daa024c5c497ec7b0d07b1d7e710d

SHA1 hash:

84f6c09a1fa00c9cb510dc8cd674aebed71a573b

Link:

https://www.unpac.me/results/cf26b668-075f-4443-80a0-e65b13fe5b59/

SH256 hash:

4a05dbd0aa6f23a0100151c528cdb3df02bd1873d3fafcc480864588320d6352

MD5 hash:

e0ade51bee049f2f3049eb8137c26fc7

SHA1 hash:

8579db18dbd8626225e7ab67602d9a30ce2931c4

Link:

https://www.unpac.me/results/cf26b668-075f-4443-80a0-e65b13fe5b59/

SH256 hash:

16fbf35ccfa2ba2d6954c266d18f7b62a8ccc72d83a8a79c3ad810ea68e4aa93

MD5 hash:

64397899c5cd141e6c5da7aab56f0f42

SHA1 hash:

aed115066979e6abebad02f7087f0b50c27963c9

Link:

https://www.unpac.me/results/cf26b668-075f-4443-80a0-e65b13fe5b59/

Malware family:

CobaltStrike

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/16fbf35ccfa2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/16fbf35ccfa2ba2d6954c266d18f7b62a8ccc72d83a8a79c3ad810ea68e4aa93

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Beacon_K5om Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Meterpreter Beacon - file K5om.dll
Reference:	https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html

Rule name:	Beacon_K5om_RID2B14 Create hunting rule
Author:	Florian Roth
Description:	Detects Meterpreter Beacon - file K5om.dll
Reference:	https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	Cobaltstrike1 Create hunting rule
Author:	Ahmet Payaslioglu \| Binalyze DFIR LAB
Description:	Cobalt Strike Detection

Rule name:	Cobaltstrike2 Create hunting rule
Author:	Ahmet Payaslioglu \| Binalyze DFIR LAB
Description:	Cobalt Strike Detection

Rule name:	Cobaltstrike3 Create hunting rule
Author:	Ahmet Payaslioglu \| Binalyze DFIR LAB
Description:	Cobalt Strike Detection

Rule name:	CobaltStrikeBeacon Create hunting rule
Author:	ditekshen, enzo & Elastic
Description:	Cobalt Strike Beacon Payload

Rule name:	CobaltStrike_C2_Encoded_XOR_Config_Indicator Create hunting rule
Author:	yara@s3c.za.net
Description:	Detects CobaltStrike C2 encoded profile configuration

Rule name:	CobaltStrike_ReflectiveLoader_RID3297 Create hunting rule
Author:	Florian Roth
Description:	Detects reflective loader (Cobalt Strike)
Reference:	http://www.clearskysec.com/tulip

Rule name:	CobaltStrike_Sleeve_BeaconLoader_x86_o_v4_3_v4_4_v4_5_and_v4_6 Create hunting rule
Author:	gssincla@google.com
Description:	Cobalt Strike's sleeve/BeaconLoader.x86.o Versions 4.3 through at least 4.6
Reference:	https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse

Rule name:	CobaltStrike_Unmodifed_Beacon Create hunting rule
Author:	yara@s3c.za.net
Description:	Detects unmodified CobaltStrike beacon DLL

Rule name:	CobaltStrike__Sleeve_BeaconLoader_x86_o_v4_3_v4_4_v4_5_and_v4_6 Create hunting rule
Author:	gssincla@google.com

Rule name:	crime_win32_csbeacon_1 Create hunting rule
Author:	@VK_Intel
Description:	Detects Cobalt Strike loader
Reference:	https://twitter.com/VK_Intel/status/1239632822358474753

Rule name:	CS_beacon Create hunting rule
Author:	Etienne Maynier tek@randhome.io

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	HKTL_CobaltStrike_Beacon_Strings Create hunting rule
Author:	Elastic
Description:	Identifies strings used in Cobalt Strike Beacon DLL
Reference:	https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures

Rule name:	HKTL_Meterpreter_inMemory Create hunting rule
Author:	netbiosX, Florian Roth
Description:	Detects Meterpreter in-memory
Reference:	https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/

Rule name:	HKTL_Win_CobaltStrike Create hunting rule
Author:	threatintel@volexity.com
Description:	The CobaltStrike malware family.
Reference:	https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/

Rule name:	INDICATOR_SUSPICIOUS_ReflectiveLoader Create hunting rule
Author:	ditekSHen
Description:	Detects Reflective DLL injection artifacts

Rule name:	Leviathan_CobaltStrike_Sample_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Cobalt Strike sample from Leviathan report
Reference:	https://goo.gl/MZ7dRg

Rule name:	Leviathan_CobaltStrike_Sample_1_RID3324 Create hunting rule
Author:	Florian Roth
Description:	Detects Cobalt Strike sample from Leviathan report
Reference:	https://goo.gl/MZ7dRg

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	malware_CobaltStrike_v3v4 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect CobaltStrike Beacon in memory
Reference:	https://blogs.jpcert.or.jp/en/2018/08/volatility-plugin-for-detecting-cobalt-strike-beacon.html

Rule name:	Malware_QA_vqgk Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	VT Research QA uploaded malware - file vqgk.dll
Reference:	VT Research QA

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	MALWARE_Win_CobaltStrike Create hunting rule
Author:	ditekSHen
Description:	CobaltStrike payload

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	PowerShell_Susp_Parameter_Combo_RID336F Create hunting rule
Author:	Florian Roth
Description:	Detects PowerShell invocation with suspicious parameters
Reference:	https://goo.gl/uAic1X

Rule name:	ReflectiveLoader Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:	Internal Research

Rule name:	SUSP_XORed_Mozilla Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	troj_win_cobaltstrike_memoryinject Create hunting rule
Author:	Jeff White (karttoon@gmail.com) @noottrak
Description:	Detects Cobalt Strike payload typically loaded into memory via PowerShell.

Rule name:	WiltedTulip_ReflectiveLoader Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:	http://www.clearskysec.com/tulip

Rule name:	Windows_Trojan_CobaltStrike_1787eef5 Create hunting rule
Author:	Elastic Security
Description:	CS shellcode variants

Rule name:	Windows_Trojan_CobaltStrike_3dc22d14 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_CobaltStrike_7f8da98a Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_CobaltStrike_ee756db7 Create hunting rule
Description:	Attempts to detect Cobalt Strike based on strings found in BEACON

Rule name:	Windows_Trojan_CobaltStrike_f0b627fc Create hunting rule
Description:	Rule for beacon reflective loader

Rule name:	Windows_Trojan_Metasploit_7bc0f998 Create hunting rule
Description:	Identifies the API address lookup function leverage by metasploit shellcode

Rule name:	Windows_Trojan_Metasploit_c9773203 Create hunting rule
Author:	Elastic Security
Description:	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:	https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm

Rule name:	win_cobaltstrike_pipe_strings_nov_2023 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects default strings related to cobalt strike named pipes

Rule name:	win_cobalt_strike_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.cobalt_strike.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::AllocateAndInitializeSid ADVAPI32.dll::FreeSid ADVAPI32.dll::GetLengthSid ADVAPI32.dll::InitializeAcl ADVAPI32.dll::InitializeSecurityDescriptor ADVAPI32.dll::MakeSelfRelativeSD
COM_BASE_API	Can Download & Execute components	ole32.dll::CLSIDFromProgID ole32.dll::CoCreateInstance ole32.dll::CoFreeUnusedLibraries ole32.dll::CreateStreamOnHGlobal
GDI_PLUS_API	Interfaces with Graphics	gdiplus.dll::GdiplusStartup gdiplus.dll::GdiplusShutdown gdiplus.dll::GdipDeleteGraphics gdiplus.dll::GdipAlloc gdiplus.dll::GdipCreateFromHDC
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::PlaySoundW
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AddAccessAllowedAce ADVAPI32.dll::SetSecurityDescriptorDacl
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteW SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::LoadLibraryW KERNEL32.dll::GetDriveTypeW KERNEL32.dll::GetVolumeInformationW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileW KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW SHLWAPI.dll::PathRemoveFileSpecW KERNEL32.dll::MoveFileExW KERNEL32.dll::GetWindowsDirectoryW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegDeleteKeyW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW
WIN_USER_API	Performs GUI Actions	USER32.dll::AppendMenuW USER32.dll::CreateMenu ole32.dll::OleCreateMenuDescriptor USER32.dll::EmptyClipboard USER32.dll::OpenClipboard USER32.dll::PeekMessageW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample