🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32ef974a4d08ccc24e7a4b6dc924b7011d605af73eb91cca47ea8d5afe4072bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Cobalt Strike


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32ef974a4d08ccc24e7a4b6dc924b7011d605af73eb91cca47ea8d5afe4072bb
SHA3-384 hash: a330e677597d72337af0c0b43372ea7c2950252c1f283398462b042b48e3d7bf62406b392fb1142f8e55bfd04555f18b
SHA1 hash: 42edb8450e5b5bafbf8d097f777f132dc05ae121
MD5 hash: bb89df3635445037967cc284a75e053c
humanhash: football-floor-maine-august
File name:32ef974a4d08ccc24e7a4b6dc924b7011d605af73eb91cca47ea8d5afe4072bb
Download: download sample
Signature Cobalt Strike
Create hunting rule
File size:819'200 bytes
First seen:2025-04-22 17:09:11 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 12288:v8tMRQ+gjpjegLyo8InRNBYIRx5sWqWcEG4QznRj6ebN+unykd+NTHVPwXKgz:0tWcpVLSeB7n5iWcv4QhmIyZRNg
Threatray 877 similar samples on MalwareBazaar
TLSH T1600501613AC8C13AD39E0A3685B79B6667367CB51B20D0CBB7903C6C9E307D2A935357
TrID 98.2% (.MSI) Microsoft Windows Installer (454500/1/170)
1.7% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter JAMESWT_WT
Tags:Cobalt Strike msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
880
Origin country :
IT IT
Vendor Threat Intelligence
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/3484/
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6807ce1ba37ff28e12981e68
Tags:
shellcode
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
crypto expand fingerprint fingerprint installer keylogger lolbin packed wix
Link:
https://www.filescan.io/uploads/6807cd82931404048d813fec/reports/0f0487eb-315e-4830-8f66-76eec2b06a41/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/32ef974a4d08ccc24e7a4b6dc924b7011d605af73eb91cca47ea8d5afe4072bb
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1671299
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1671299 Sample: FfDR885Mn1.msi Startdate: 22/04/2025 Architecture: WINDOWS Score: 84 38 cdn.soft.qianxin.com 2->38 40 cdn.soft.qianxin.com.w.kunluncan.com 2->40 44 Found malware configuration 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 Antivirus detection for URL or domain 2->48 50 2 other signatures 2->50 9 msiexec.exe 3 10 2->9         started        12 msiexec.exe 5 2->12         started        signatures3 process4 file5 36 C:\Windows\Installer\MSI802B.tmp, PE32 9->36 dropped 14 msiexec.exe 5 9->14         started        process6 process7 16 expand.exe 5 14->16         started        19 install.exe 14->19         started        22 icacls.exe 1 14->22         started        dnsIp8 28 C:\Users\user\AppData\...\install.exe (copy), PE32+ 16->28 dropped 30 C:\Users\user\...\UsbDkHelper.dll (copy), PE32+ 16->30 dropped 32 C:\...\e4c216699d92d54794058693f1790cfe.tmp, PE32+ 16->32 dropped 34 C:\...\b702d91fb0c05642a2d87b0e917a3f2f.tmp, PE32+ 16->34 dropped 24 conhost.exe 16->24         started        42 cdn.soft.qianxin.com.w.kunluncan.com 101.226.27.115, 443, 49716 CHINANET-SH-APChinaTelecomGroupCN China 19->42 26 conhost.exe 22->26         started        file9 process10
Score:
89%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/32ef974a4d08ccc24e7a4b6dc924b7011d605af73eb91cca47ea8d5afe4072bb
Detection:
cobaltstrike
Create hunting rule
Link:
https://mwdb.cert.pl/sample/32ef974a4d08ccc24e7a4b6dc924b7011d605af73eb91cca47ea8d5afe4072bb/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=glxzossnbdgmett2jnw4sjfxaeowawxxh24rzssh5kgvv7saok5q._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
066d9b1ea812e5cac61c8cdf00cb0770c9f2c5d4062e60c5924927b0a619e998
Cobalt Strike
4c130e3f9b3727a47d22536e8e752f166757752221b17a03c01e90f7f582eaac
Cobalt Strike
6777ddc8f739401969e16487f1cabadcb16f8bdb20527926e8d7d2535bb95879
Cobalt Strike
68f47a7e0f69a946019a113635c5b55ec78abb0e8108ac1e285b7568093e4e50
Cobalt Strike
76c73380cc4deb30cbfbe8a7fd551da5aba1150505fb5b0b66599e4ba491848b
Cobalt Strike
8b6c6c007efa8e1a7da241564142f8a8a934dcce451c7e522cdd86292e81ead7
Cobalt Strike
dd4db8e858f1bfbdb7a384e16d5da0ee97537d281c7e6d20c4f323d5ebfbc9c7
Cobalt Strike
error
Cobalt Strike
+ 867 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence privilege_escalation
Link:
https://tria.ge/reports/250422-vpcn6swlw8/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Enumerates connected drives
Modifies file permissions
Malware Family:
n/a
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/8292a023-32da-46e6-9a4c-05b4f94c2c90
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/32ef974a4d08/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/3484/

Comments