MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1fa91a1c228de13e0d24d2d0edc83e01bb848f16afb1849b48b3060299afcb58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1fa91a1c228de13e0d24d2d0edc83e01bb848f16afb1849b48b3060299afcb58
SHA3-384 hash: f5a04d336228c9295bab6889fec4a98c6af70873497922fcedcfd6bb833995df309ee3624719b5ede6fc630a341ba20b
SHA1 hash: 7cd1441accc50a77b2ff05f557036a8909a452da
MD5 hash: 75b8fac9943fa84d70ea564fcf02bfd2
humanhash: saturn-delaware-oregon-harry
File name:cs.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:225'792 bytes
First seen:2021-10-06 08:03:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 829da329ce140d873b4a8bde2cbfaa7e (259 x CobaltStrike)
ssdeep 6144:aAgVsBSj9evYwdtYxTrXlNs6ivcQKXF2:aRP9evYCt4X4bgs
Threatray 527 similar samples on MalwareBazaar
TLSH T1C524DF73EA1658B4D4F62B7B8923D331CD2E87A7355159CD7A38D24023B292B2C9538F
Reporter drb_ra
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
543
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cobaltstrike_shellcode.exe
Verdict:
No threats detected
Analysis date:
2021-10-06 08:03:04 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0c834dd6-c4ae-497e-8404-35966db25ef1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/195319/
Detection(s):
SecuriteInfo.com.Crypt5.BLLV.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug obfuscated packed
Link:
https://www.filescan.io/uploads/615d583ee3d213d202b84568/reports/2d89383a-f390-4e82-b1ed-e11c7bef3933/overview
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ce5add27-bc1e-43b1-b1a2-465544621337
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/865323
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1fa91a1c228de13e0d24d2d0edc83e01bb848f16afb1849b48b3060299afcb58/
Threat name:
Win32.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2021-10-06 08:03:11 UTC
AV detection:
39 of 45 (86.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d6uruhbcrxqt4dje2lio3sb6ag5yjdywv6yyjg2iwmdafgnpznma._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
0c9d0a13c4e91cdb0f8dd1f2b2907febaf80e12b8357db5eb2a7ed889e80a3f3
CobaltStrike
0db962ed407baa67225879ef022f236cca87d6129048dc57b7801166a00b9029
CobaltStrike
216c8471db4ab3a785f395c8c059d767798a6ffd5fbbf6e72f745ea506bd1cd9
CobaltStrike
3c67fe0c0c8be9d42088882a993855ba0430fa883a1abd6b76a60295412ca08f
CobaltStrike
5701a3c3a5ba47dfdf1fa7b70335419c2889b6649d30964145f68815920f7616
CobaltStrike
6ac2039e43e60219904490b423d389c254946fa6681b136b4a490586d269a646
CobaltStrike
8fad3190f946b88c729be6cd98c87b9bdc5ee9ed966b5c89776665a316471ad9
CobaltStrike
95c7ff271eef622e799e62be523d4df8d11a6c97ac662ed2a6850f3b1b3f8220
CobaltStrike
de9276fe0d69980d3ab80be2883bef46bd5979234ada3b221c4f415103b6cc71
CobaltStrike
fa446884329eeaa616d9c38d1c7cf1c79a439984abd79f921417d92e4de0c02a
CobaltStrike
+ 517 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:665745135 backdoor trojan
Link:
https://tria.ge/reports/211006-jxrbrabacn/
Behaviour
Cobaltstrike
Malware Config
C2 Extraction:
http://yelp.com:443/gp/aj/private/reviewsGallery/get-application-resources
http://bbc.com:443/api2/json/cluster/resources
http://nytimes.com:443/en-us/p/onerf/MeSilentPassport
http://dictionary.com:443/en-us/p/onerf/MeSilentPassport
Unpacked files
SH256 hash:
94e3d14fa16dfbcadace58bfe6c94aaf7c8908752274ab061a19dba3f79a1a80
MD5 hash:
e20976034969805d065844edf555f2c7
SHA1 hash:
b07723816a121b8f373944e2b2ef618e6e9b117c
Link:
https://www.unpac.me/results/06672ff8-5e7f-4d56-b4b7-c1d3a666ff6a/
SH256 hash:
1fa91a1c228de13e0d24d2d0edc83e01bb848f16afb1849b48b3060299afcb58
MD5 hash:
75b8fac9943fa84d70ea564fcf02bfd2
SHA1 hash:
7cd1441accc50a77b2ff05f557036a8909a452da
Link:
https://www.unpac.me/results/06672ff8-5e7f-4d56-b4b7-c1d3a666ff6a/
Malware family:
Cobalt Strike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/1fa91a1c228d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1fa91a1c228de13e0d24d2d0edc83e01bb848f16afb1849b48b3060299afcb58

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobaltbaltstrike_Beacon_XORed_x86
Create hunting rule
Author:Avast Threat Intel Team
Description:Detects CobaltStrike payloads
Reference:https://github.com/avast/ioc
Rule name:Cobaltbaltstrike_strike_Payload_XORed
Create hunting rule
Author:Avast Threat Intel Team
Description:Detects CobaltStrike payloads
Reference:https://github.com/avast/ioc
Rule name:HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5
Create hunting rule
Author:Florian Roth
Description:Detects strings found in CobaltStrike shellcode
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Rule name:HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5_RID361D
Create hunting rule
Author:Florian Roth
Description:Detects strings found in malware samples in APT report in DarkHydrus
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/195319/

Comments