MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f4fc4fa579889b69b00bf7a19ae05eb737bc8afdcb41858761d678fa232a6c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 17


Intelligence 17 IOCs YARA 43 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2f4fc4fa579889b69b00bf7a19ae05eb737bc8afdcb41858761d678fa232a6c1
SHA3-384 hash: 7d411ddee05639c2a8b0fe89dabb4ed7eb37073a4dce4b00a99fabcca9bd75564b1f1974332bd2305d46f3a9705e5017
SHA1 hash: 9203dc6237bc63fa16543415550e99919557f69d
MD5 hash: d8d8cb60d196a26765261b1ca8604d1e
humanhash: pennsylvania-april-five-lactose
File name:d8d8cb60d196a26765261b1ca8604d1e
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:284'672 bytes
First seen:2022-12-12 04:47:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash dc25ee78e2ef4d36faa0badf1e7461c9 (118 x CobaltStrike, 5 x Cobalt Strike)
ssdeep 6144:kReAPthOUKR5z6VrRLM7VEq8Hnm1wb+1ES:kIAlhNKR5zELM7LyWw61
Threatray 772 similar samples on MalwareBazaar
TLSH T14454CFC05E9185B1CCB7CDF5C90AF96CFA2ED6759800475BB30D2C8019ADEB141BBEA2
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10523/12/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter zbetcheckin
Tags:32 CobaltStrike exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
230
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d8d8cb60d196a26765261b1ca8604d1e
Verdict:
Malicious activity
Analysis date:
2022-12-12 10:37:31 UTC
Tags:
cobalt
Link:
https://app.any.run/tasks/52c72e37-f5d8-454c-881e-af1a4d5fdfd9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/345323/
Detection(s):
Win.Trojan.CobaltStrike-7899872-1
Create hunting rule

Win.Countermeasure.LoaderWinGeneric-9804845-2
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/6396b28404e0e79bdf425be9/reports/ec4324f2-70e4-4b3f-aa06-7aafd7dce078/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Cobalt Strike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5ef78c19-cbb1-456e-9b6b-267ac77ea4d9
Result
Threat name:
CobaltStrike, ReflectiveLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1132399
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Yara detected ReflectiveLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
cobaltstrike
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2f4fc4fa579889b69b00bf7a19ae05eb737bc8afdcb41858761d678fa232a6c1/
Threat name:
Win32.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2022-12-11 02:52:25 UTC
File Type:
PE (Exe)
AV detection:
25 of 26 (96.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f5h4j6sxtce3ngyax55btlqf5nzxxsfp3s2bqwdwdvty7irsu3aq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
0b88dd821cf352dd46cd57c0a5cc4542fead6bf4afe82ff1a52939be744df0ad
CobaltStrike
0e30a27d44484b9baa56e7b6050581e3edc3bd1b426057c85824d0cac493a3f1
CobaltStrike
12b960dd90803aa2fb3af2468a0b117ca335e23ba5cf7cbb96f9cdcb97650871
CobaltStrike
5aedcd88018ef8f4a70a04ca259e7f2a087fde8ef98c7bbe21b1d511dd00a731
CobaltStrike
669fcafcaf217a0ae7776d1c98b6cbb4fd75fb97b12965185136a09c7bfc0ef2
CobaltStrike
7d536b270b9bf18abaa1aac2515293cc30271ead88038fcefe7c04612b9a5c41
CobaltStrike
85bfd98e0bfdaa6be0b1d856bdbb23ddc32f4891a9cec6e08d7b3c47666f68c4
CobaltStrike
a2bcce439cb511eca635e14943b916e86a121c7062ac978437d2d080a54fff26
CobaltStrike
f4ca63aeb4e3246c5d923942497d650bc3920c9fbc78a330ecf9d7db67e0cb8f
CobaltStrike
fad4aa474affa78e820e731061ed7614feba095422465f0ca4c05a1f3506beb8
CobaltStrike
+ 762 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike backdoor trojan
Link:
https://tria.ge/reports/221212-fe4ycada5t/
Behaviour
Cobaltstrike
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d85647a8-3770-4f51-b605-85a4eaf20c4f
Unpacked files
SH256 hash:
4f5856b0c47b5a4254bfcdde74e598ba00239c567487fd61b8a69e3e81b786f1
MD5 hash:
fb6723f71d7238000ccd9ed59bb92118
SHA1 hash:
0a5f8c9926999901205964eeb57fa05bd259081d
Detections:
cobaltstrike_xor_config
Create hunting rule
win_cobalt_strike_auto
Create hunting rule
Link:
https://www.unpac.me/results/af0cdce1-4c1b-4566-9970-b50ac8dc16cf/
SH256 hash:
2f4fc4fa579889b69b00bf7a19ae05eb737bc8afdcb41858761d678fa232a6c1
MD5 hash:
d8d8cb60d196a26765261b1ca8604d1e
SHA1 hash:
9203dc6237bc63fa16543415550e99919557f69d
Link:
https://www.unpac.me/results/af0cdce1-4c1b-4566-9970-b50ac8dc16cf/
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2f4fc4fa5798/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2f4fc4fa579889b69b00bf7a19ae05eb737bc8afdcb41858761d678fa232a6c1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Beacon_K5om
Create hunting rule
Author:Florian Roth
Description:Detects Meterpreter Beacon - file K5om.dll
Reference:https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html
Rule name:Beacon_K5om_RID2B14
Create hunting rule
Author:Florian Roth
Description:Detects Meterpreter Beacon - file K5om.dll
Reference:https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html
Rule name:Cobaltstrike1
Create hunting rule
Author:Ahmet Payaslioglu | Binalyze DFIR LAB
Description:Cobalt Strike Detection
Rule name:Cobaltstrike2
Create hunting rule
Author:Ahmet Payaslioglu | Binalyze DFIR LAB
Description:Cobalt Strike Detection
Rule name:Cobaltstrike3
Create hunting rule
Author:Ahmet Payaslioglu | Binalyze DFIR LAB
Description:Cobalt Strike Detection
Rule name:CobaltStrikeBeacon
Create hunting rule
Author:ditekshen, enzo & Elastic
Description:Cobalt Strike Beacon Payload
Rule name:CobaltStrike_C2_Encoded_XOR_Config_Indicator
Create hunting rule
Author:yara@s3c.za.net
Description:Detects CobaltStrike C2 encoded profile configuration
Rule name:CobaltStrike_ReflectiveLoader_RID3297
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike)
Reference:http://www.clearskysec.com/tulip
Rule name:CobaltStrike_Resources_Artifact32_v3_14_to_v4_x
Create hunting rule
Author:gssincla@google.com
Description:Cobalt Strike's resources/artifact32{.dll,.exe,big.exe,big.dll,bigsvc.exe} signature for versions 3.14 to 4.x and resources/artifact32svc.exe for 3.14 to 4.x and resources/artifact32uac.dll for v3.14 and v4.0
Reference:https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse
Rule name:CobaltStrike_Sleeve_BeaconLoader_VA_x86_o_v4_3_v4_4_v4_5_and_v4_6
Create hunting rule
Author:gssincla@google.com
Description:Cobalt Strike's sleeve/BeaconLoader.VA.x86.o (VirtualAlloc) Versions 4.3 through at least 4.6
Reference:https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse
Rule name:CobaltStrike_Sleeve_Beacon_Dll_v4_3_v4_4_v4_5_and_v4_6
Create hunting rule
Author:gssincla@google.com
Description:Cobalt Strike's sleeve/beacon.dll Versions 4.3 and 4.4
Reference:https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse
Rule name:CobaltStrike_Unmodifed_Beacon
Create hunting rule
Author:yara@s3c.za.net
Description:Detects unmodified CobaltStrike beacon DLL
Rule name:CobaltStrike__Resources_Artifact32_v3_14_to_v4_x
Create hunting rule
Author:gssincla@google.com
Rule name:CobaltStrike__Sleeve_BeaconLoader_VA_x86_o_v4_3_v4_4_v4_5_and_v4_6
Create hunting rule
Author:gssincla@google.com
Rule name:CobaltStrike__Sleeve_Beacon_Dll_v4_3_v4_4_v4_5_and_v4_6
Create hunting rule
Author:gssincla@google.com
Rule name:crime_win32_csbeacon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Cobalt Strike loader
Reference:https://twitter.com/VK_Intel/status/1239632822358474753
Rule name:CS_beacon
Create hunting rule
Author:Etienne Maynier tek@randhome.io
Rule name:HKTL_CobaltStrike_Beacon_4_2_Decrypt
Create hunting rule
Author:Elastic
Description:Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_CobaltStrike_Beacon_Strings
Create hunting rule
Author:Elastic
Description:Identifies strings used in Cobalt Strike Beacon DLL
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_Meterpreter_inMemory
Create hunting rule
Author:netbiosX, Florian Roth
Description:Detects Meterpreter in-memory
Reference:https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Rule name:HKTL_Win_CobaltStrike
Create hunting rule
Author:threatintel@volexity.com
Description:The CobaltStrike malware family.
Reference:https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
Rule name:INDICATOR_SUSPICIOUS_ReflectiveLoader
Create hunting rule
Author:ditekSHen
Description:detects Reflective DLL injection artifacts
Rule name:Leviathan_CobaltStrike_Sample_1
Create hunting rule
Author:Florian Roth
Description:Detects Cobalt Strike sample from Leviathan report
Reference:https://goo.gl/MZ7dRg
Rule name:Leviathan_CobaltStrike_Sample_1_RID3324
Create hunting rule
Author:Florian Roth
Description:Detects Cobalt Strike sample from Leviathan report
Reference:https://goo.gl/MZ7dRg
Rule name:malware_CobaltStrike_v3v4
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect CobaltStrike Beacon in memory
Reference:https://blogs.jpcert.or.jp/en/2018/08/volatility-plugin-for-detecting-cobalt-strike-beacon.html
Rule name:Malware_QA_vqgk
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file vqgk.dll
Reference:VT Research QA
Rule name:MALWARE_Win_CobaltStrike
Create hunting rule
Author:ditekSHen
Description:CobaltStrike payload
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:PowerShell_Susp_Parameter_Combo_RID336F
Create hunting rule
Author:Florian Roth
Description:Detects PowerShell invocation with suspicious parameters
Reference:https://goo.gl/uAic1X
Rule name:ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:SUSP_XORed_Mozilla
Create hunting rule
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:troj_win_cobaltstrike_memoryinject
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Detects Cobalt Strike payload typically loaded into memory via PowerShell.
Rule name:WiltedTulip_ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:http://www.clearskysec.com/tulip
Rule name:Windows_Trojan_CobaltStrike_1787eef5
Create hunting rule
Author:Elastic Security
Description:CS shellcode variants
Rule name:Windows_Trojan_CobaltStrike_b54b94ac
Create hunting rule
Author:Elastic Security
Description:Rule for beacon sleep obfuscation routine
Rule name:Windows_Trojan_CobaltStrike_ee756db7
Create hunting rule
Author:Elastic Security
Description:Attempts to detect Cobalt Strike based on strings found in BEACON
Rule name:Windows_Trojan_CobaltStrike_f0b627fc
Create hunting rule
Author:Elastic Security
Description:Rule for beacon reflective loader
Rule name:Windows_Trojan_Metasploit_7bc0f998
Create hunting rule
Author:Elastic Security
Description:Identifies the API address lookup function leverage by metasploit shellcode
Rule name:Windows_Trojan_Metasploit_c9773203
Create hunting rule
Author:Elastic Security
Description:Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm
Rule name:win_cobalt_strike_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.cobalt_strike.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CobaltStrike

Executable exe 2f4fc4fa579889b69b00bf7a19ae05eb737bc8afdcb41858761d678fa232a6c1

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2454613/
Cape
Cape
https://www.capesandbox.com/analysis/345323/

Comments


Avatar
zbet commented on 2022-12-12 04:47:13 UTC

url : hxxp://167.88.170.23/43.exe