MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e9e313fbfbcb2c391c8bb8732790396ece81587944ffd829b3fc1d7733b39cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 12


Intelligence 12 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e9e313fbfbcb2c391c8bb8732790396ece81587944ffd829b3fc1d7733b39cc
SHA3-384 hash: 8b8c3106231c04fb204ad1081fba6b6a692b61c630663ae587dfebacd5639722cb37acfd14fb12b682c32bac6c10575c
SHA1 hash: 210fbf137c03615cc33b34bf6a1943ad1201b280
MD5 hash: 83d2d38054392486a19df8e956ba7c53
humanhash: yankee-robin-delta-avocado
File name:1e9e313fbfbcb2c391c8bb8732790396ece81587944ffd829b3fc1d7733b39cc
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:113'152 bytes
First seen:2023-09-25 21:38:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b80f9a3caeabbd97ef3418216ac93c69 (2 x CobaltStrike)
ssdeep 1536:oNmwHfH0SqhYouQSVzlflSPJaSACePVLzZwcFEzsWTdw9dlHSORcb:oNmw/RRNvluJZAz9LzWiEbAoORc
Threatray 1 similar samples on MalwareBazaar
TLSH T1F6B36C0763A904BBF4778639C8930E49D372B8150760AFAF07A087961F637A19D3EF65
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter StrangerealIntel
Tags:Cobalt Strike exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
304
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
CobaltStrikeStager
Create hunting rule
Link:
https://www.capesandbox.com/analysis/451125/
Detection(s):
Win.Trojan.MSShellcode-5
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm cobalt cobaltstrike greyware swrort
Link:
https://www.filescan.io/uploads/6511fdf883a0c6425dff5a61/reports/58e5c6d3-f637-4aa3-9e08-d79374c9eefa/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/1e9e313fbfbcb2c391c8bb8732790396ece81587944ffd829b3fc1d7733b39cc
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/25769b36-89c4-45f0-820e-e8018b0f2c3d
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1314172
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1314172 Sample: HxURnd7ABS.exe Startdate: 25/09/2023 Architecture: WINDOWS Score: 96 28 Found malware configuration 2->28 30 Malicious sample detected (through community Yara rule) 2->30 32 Antivirus / Scanner detection for submitted sample 2->32 34 4 other signatures 2->34 8 loaddll64.exe 7 2->8         started        process3 process4 10 rundll32.exe 8->10         started        13 cmd.exe 1 8->13         started        15 rundll32.exe 6 8->15         started        17 32 other processes 8->17 signatures5 36 System process connects to network (likely due to code injection or exploit) 10->36 19 rundll32.exe 6 13->19         started        22 WerFault.exe 9 15->22         started        process6 dnsIp7 26 121.5.22.133, 21786, 49774, 49777 ONQ-AS-APOnQAU China 19->26 24 WerFault.exe 20 9 19->24         started        process8
Detection:
cobaltstrike
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1e9e313fbfbcb2c391c8bb8732790396ece81587944ffd829b3fc1d7733b39cc/
Threat name:
Win64.Backdoor.CobaltStrikeBeacon
Create hunting rule
Status:
Malicious
First seen:
2023-06-15 13:03:00 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d2pdcp57xszmheoixodte6ids3woqfmhsrh73au3h7a5o4z3hhga._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
da299be7f0cc9d71cdea150c0951dd6e4b121b65882a5bf2826f59dd02ea0ab5
CobaltStrike
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike backdoor trojan
Link:
https://tria.ge/reports/230925-1hlw6add37/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Blocklisted process makes network request
Cobaltstrike
Malware Config
C2 Extraction:
http://121.5.22.133:21786/hY4h
Unpacked files
SH256 hash:
1e9e313fbfbcb2c391c8bb8732790396ece81587944ffd829b3fc1d7733b39cc
MD5 hash:
83d2d38054392486a19df8e956ba7c53
SHA1 hash:
210fbf137c03615cc33b34bf6a1943ad1201b280
Link:
https://www.unpac.me/results/ed48a100-a408-4de5-89a4-f76e703c5df3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1e9e313fbfbcb2c391c8bb8732790396ece81587944ffd829b3fc1d7733b39cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobaltbaltstrike_RAW_Payload_http_stager_x64
Create hunting rule
Author:Avast Threat Intel Team
Description:Detects CobaltStrike payloads
Reference:https://github.com/avast/ioc
Rule name:CobaltStrikeStager
Create hunting rule
Author:@dan__mayer <daniel@stairwell.com>
Description:Cobalt Strike Stager Payload
Rule name:CobaltStrike_Resources_Httpstager64_Bin_v3_2_through_v4_x
Create hunting rule
Author:gssincla@google.com
Description:Cobalt Strike's resources/httpstager64.bin signature for versions v3.2 to v4.x
Reference:https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse
Rule name:CobaltStrike__Resources_Httpstager64_Bin_v3_2_through_v4_x
Create hunting rule
Author:gssincla@google.com
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:Windows_Trojan_Metasploit_7bc0f998
Create hunting rule
Author:Elastic Security
Description:Identifies the API address lookup function leverage by metasploit shellcode
Rule name:Windows_Trojan_Metasploit_7bc0f998
Create hunting rule
Description:Identifies the API address lookup function leverage by metasploit shellcode
Rule name:Windows_Trojan_Metasploit_c9773203
Create hunting rule
Author:Elastic Security
Description:Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm
Rule name:Windows_Trojan_Metasploit_c9773203
Create hunting rule
Description:Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/451125/

Comments