MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bfe11c06ffe157399432080f6de6190e1062c99b4a55ec31974b5a37ee8dd3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2bfe11c06ffe157399432080f6de6190e1062c99b4a55ec31974b5a37ee8dd3c
SHA3-384 hash: d7491a05a63343d35faaaf57bacd1a602ebd244a693733bfefee9a608f427dd649eb0966b06d5b4ebfd339cb22504c41
SHA1 hash: 173e0de913fa275e3ef31f394b9479a0a1eabaee
MD5 hash: 41c9aa93d70b7a5238a262f6e3971415
humanhash: whiskey-oklahoma-thirteen-aspen
File name:zdn8C7D.tmp
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:186'336 bytes
First seen:2021-07-15 18:14:38 UTC
Last seen:2021-07-20 06:13:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5113cba6ae071e97cfe94fe34d571ccb (2 x CobaltStrike)
ssdeep 3072:YFWfdwyBiA7gqEyD3eKM3G51TcrI0q4h8pCov90780t/tsX3/9Cy:YofdwyB17kOOK59cq4h8pVvZP9D
Threatray 1'071 similar samples on MalwareBazaar
TLSH T12A04AD14B2A110AFFE2A45B28A934605B57235214334DFEF03A48775DF0EBE25A7DB39
Reporter malware_traffic
Tags:Cobalt Strike CobaltStrike dll


Avatar
malware_traffic
Run method: rundll32.exe [filename],StartW

Intelligence

File Origin
# of uploads :
3
# of downloads :
540
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
zdn8C7D.tmp
Verdict:
No threats detected
Analysis date:
2021-07-15 18:13:55 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/548f6873-1816-4c63-879b-7d0509965fab

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/172060/
Detection(s):
SecuriteInfo.com.W32.Trojan.Cobaltstrike.9776.19025.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/d632c880-8657-4b67-ba0e-8f6fd6d41014
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/817116
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Sigma detected: CobaltStrike Load by Rundll32
System process connects to network (likely due to code injection or exploit)
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 449527 Sample: zdn8C7D.tmp Startdate: 15/07/2021 Architecture: WINDOWS Score: 92 24 Multi AV Scanner detection for domain / URL 2->24 26 Found malware configuration 2->26 28 Malicious sample detected (through community Yara rule) 2->28 30 3 other signatures 2->30 7 loaddll64.exe 1 2->7         started        process3 process4 9 rundll32.exe 6 7->9         started        13 rundll32.exe 6 7->13         started        15 cmd.exe 1 7->15         started        dnsIp5 22 minicombosoft.com 88.80.148.177, 443, 49744, 49746 BELCLOUDBG Bulgaria 9->22 32 System process connects to network (likely due to code injection or exploit) 9->32 17 rundll32.exe 6 15->17         started        signatures6 process7 dnsIp8 20 minicombosoft.com 17->20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2bfe11c06ffe157399432080f6de6190e1062c99b4a55ec31974b5a37ee8dd3c/
Threat name:
Win64.Trojan.Shelma
Create hunting rule
Status:
Malicious
First seen:
2021-07-15 18:15:07 UTC
AV detection:
2 of 46 (4.35%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
132bdcb986e3e3b9599b5b293b3318e7c630495e87a9d1fa02287ae80f9e652f
CobaltStrike
1c8de01df040c973b37ae5ce8e1bb523e1ba24a9c25263706022f9a9894a2e50
CobaltStrike
54094b2385ea86406ad20d865e6c03ec6233187e293d3d982d281d0237b552dc
CobaltStrike
673d8268fd21825ca5f21d8b395cdcede7009b60e540cb36c46f5794626faefb
CobaltStrike
6cf0a44011ec1e1a891d7d06357c4687634e42d65a3eecfe9180e608b5d6e150
CobaltStrike
9ca6449c0586a77c55586bcc7adfaef2c3cc53da4713c5ed57fced15a3054545
CobaltStrike
a93eb70cc4152e32cd3a39fda968b2da5ade48453927410a0d520f2d13223d11
CobaltStrike
cb01f31a322572035cf19f6cda00bcf1d8235dcc692588810405d0fc6e8d239c
CobaltStrike
cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58
CobaltStrike
d03b1d500e960377df77a72c5074b4c56b29f938f48ecd03ac846b38d3c914d3
CobaltStrike
+ 1'061 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:0 backdoor trojan
Link:
https://tria.ge/reports/210715-vk4blw6wq6/
Behaviour
Modifies system certificate store
Blocklisted process makes network request
Cobaltstrike
Malware Config
C2 Extraction:
http://minicombosoft.com:443/jquery-3.3.1.min.js
Unpacked files
SH256 hash:
2bfe11c06ffe157399432080f6de6190e1062c99b4a55ec31974b5a37ee8dd3c
MD5 hash:
41c9aa93d70b7a5238a262f6e3971415
SHA1 hash:
173e0de913fa275e3ef31f394b9479a0a1eabaee
Link:
https://www.unpac.me/results/a4f55034-6b28-449c-9afe-bf70ee7bc53c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2bfe11c06ffe157399432080f6de6190e1062c99b4a55ec31974b5a37ee8dd3c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CobaltStrike

Executable exe 2bfe11c06ffe157399432080f6de6190e1062c99b4a55ec31974b5a37ee8dd3c

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/172060/
  
URLhaus
https://urlhaus.abuse.ch/url/1457299/
  
Delivery method
Distributed via web download

Comments