MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24cf3b356d4acc1b6179d535a8aae85d52d53c926f2021fa9ae67b5f7fc37140. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24cf3b356d4acc1b6179d535a8aae85d52d53c926f2021fa9ae67b5f7fc37140
SHA3-384 hash: f4ad729ec57b634c395f97abe90a4216dfc02d229ed14879dbd04e0e96369d99dc1c8ca99165853fa49fa76c6684c458
SHA1 hash: 06817bf800adb450dab15516439b93c357aa0dd9
MD5 hash: e349c5d7b410121396f0b361e518727b
humanhash: beryllium-freddie-rugby-stream
File name:24cf3b356d4acc1b6179d535a8aae85d52d53c926f2021fa9ae67b5f7fc37140
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:884'704 bytes
First seen:2021-09-15 09:50:07 UTC
Last seen:2021-09-15 11:03:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ce66dec22fac2ece41071e4eed93020e (1 x CobaltStrike)
ssdeep 12288:bZt2MQrc8ywhZ6wTqjX9Fzqia6wdNbZngW8a4KVsghN:DIOqQwTqjXDba6w54dg3
Threatray 1'266 similar samples on MalwareBazaar
TLSH T106158C0FF6A4C5A5D033D579C9938686EAF278A49730D7CB5280EF2D1E366E15D3A320
dhash icon e886a20000a286e0 (1 x CobaltStrike)
Reporter JAMESWT_WT
Tags:CobaltStrike exe HasCred ApS signed

Code Signing Certificate

Organisation:HasCred ApS
Issuer:DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:sha256WithRSAEncryption
Valid from:2021-08-17T00:00:00Z
Valid to:2022-08-02T23:59:59Z
Serial number: 0bc9b800f480691bd6b60963466b0c75
Intelligence: 7 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: 1a969ab1408c6de5689ece63e3200ac2d5cf7ae2e811c6756e3f39578a45053e
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
519
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
24cf3b356d4acc1b6179d535a8aae85d52d53c926f2021fa9ae67b5f7fc37140
Verdict:
No threats detected
Analysis date:
2021-09-15 09:56:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5c58acf0-6676-4ebe-9d5e-9e2b501684cc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/188136/
Detection(s):
SecuriteInfo.com.Trojan.Siggen15.4167.11859.2102.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Connection attempt to an infection source
DNS request
Connection attempt
Sending an HTTP GET request
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6175193edb358dd15ed9258e/reports/ae036c73-ee0e-4d08-99ef-8bd2639c9d08/overview
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/06519b94-df7e-44b9-9ac0-8838e98ef6ca
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/851296
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
cobaltstrike
Create hunting rule
Link:
https://mwdb.cert.pl/sample/24cf3b356d4acc1b6179d535a8aae85d52d53c926f2021fa9ae67b5f7fc37140/
Threat name:
Win64.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2021-09-15 09:50:00 UTC
File Type:
PE+ (Exe)
Extracted files:
41
AV detection:
8 of 45 (17.78%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
1196cd7aca5d5576e3d142339e6d7fd9325f4210c6ae196065d766a1468da08c
CobaltStrike
14d35d94f1423f8611dd77fb5da29a006a7a59cc9ccd549c46cba36c017b1d2f
CobaltStrike
6880a560c6cc3dd49bdc94a90dcc8dc69e55a6d842e76bb0dff0038bad6a762f
CobaltStrike
9062e1a48d6531e8022521aebcecbe7913281c1dc282f3230c280f72cf5fca49
CobaltStrike
97fbb35c5073af391068712aa31992c2d6d174c8c297baef188d687fe6f4fd62
CobaltStrike
cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58
CobaltStrike
cf1043d00d87887f92a59e86296d1b7acaf37ccb33e9d2ce1f3c40d669de8ed5
CobaltStrike
d1d0c9d1ee7b800d491c9fb3fc94b93e5c59d903a4debb092846c46481077ae0
CobaltStrike
+ 1'256 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:0 backdoor trojan
Link:
https://tria.ge/reports/210915-lvg2eaadf5/
Behaviour
Suspicious use of SetWindowsHookEx
Cobaltstrike
Malware Config
C2 Extraction:
http://d1n2x5h0loustn.cloudfront.net:443/jquery-3.3.1.min.js
Unpacked files
SH256 hash:
24cf3b356d4acc1b6179d535a8aae85d52d53c926f2021fa9ae67b5f7fc37140
MD5 hash:
e349c5d7b410121396f0b361e518727b
SHA1 hash:
06817bf800adb450dab15516439b93c357aa0dd9
Link:
https://www.unpac.me/results/bebe912b-5318-4083-a47a-e9a6dfa17b28/
Malware family:
Cobalt Strike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/24cf3b356d4a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.82
Link:
https://yomi.yoroi.company/submissions/24cf3b356d4acc1b6179d535a8aae85d52d53c926f2021fa9ae67b5f7fc37140

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/188136/

Comments