🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 336bd53861dfdcb433486bc852127c77ccc3234de79582b39639d2aacf5fd2aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 336bd53861dfdcb433486bc852127c77ccc3234de79582b39639d2aacf5fd2aa
SHA3-384 hash: ff5f00c46f873094142c5029a972055c723fdad04fdac687284be78aed1b045fcb941e8abfb377026c41ecfe3853b137
SHA1 hash: 6f1ddffe2128455269ca493116e34f8d03931c6e
MD5 hash: 736ddbe16e777f145461c3d1444994c0
humanhash: india-moon-carpet-enemy
File name:336bd53861dfdcb433486bc852127c77ccc3234de79582b39639d2aacf5fd2aa.bin
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:306'688 bytes
First seen:2021-06-01 23:46:57 UTC
Last seen:2021-06-02 01:15:17 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 4c87e913f89b91a225d7e97a247d74fa (2 x CobaltStrike)
ssdeep 6144:eS+SUvY2lH9F9hUVHbutYsATDaqeKOQe0d9:eS+XvY2ysAnaqepz
Threatray 286 similar samples on MalwareBazaar
TLSH E164D04076A3F0E8E6FD813405EA85614B2DB93DDAA478E7EE4451CD2F646C00DFEAD2
Reporter Arkbird_SOLG
Tags:Cobalt Strike CobaltStrike dll NOBELIUM

Intelligence

File Origin
# of uploads :
2
# of downloads :
503
Origin country :
n/a
Vendor Threat Intelligence
Detection:
CobaltStrike
Create hunting rule
Link:
https://www.capesandbox.com/analysis/163902/
Detection(s):
SecuriteInfo.com.DeepScan.Generic.Exploit.Shellcode.2.A2D393C2.30729.9368.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/795570
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Rundll32 performs DNS lookup (likely malicious behavior)
System process connects to network (likely due to code injection or exploit)
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 427969 Sample: uQxymspDNa.bin Startdate: 02/06/2021 Architecture: WINDOWS Score: 84 46 6685a7f6.store.giftbox4u.com 2->46 48 6685a7f6.dns.giftbox4u.com 2->48 50 10 other IPs or domains 2->50 63 Found malware configuration 2->63 65 Malicious sample detected (through community Yara rule) 2->65 67 Yara detected CobaltStrike 2->67 71 2 other signatures 2->71 9 loaddll32.exe 1 2->9         started        11 explorer.exe 8 13 2->11         started        13 explorer.exe 12 2->13         started        15 explorer.exe 2->15         started        signatures3 69 System process connects to network (likely due to code injection or exploit) 48->69 process4 process5 17 rundll32.exe 9->17         started        21 cmd.exe 1 9->21         started        23 rundll32.exe 9->23         started        dnsIp6 34 6685a7f6.store.giftbox4u.com 17->34 36 6685a7f6.dns.giftbox4u.com 17->36 42 10 other IPs or domains 17->42 59 System process connects to network (likely due to code injection or exploit) 17->59 61 Rundll32 performs DNS lookup (likely malicious behavior) 17->61 25 explorer.exe 1 17->25         started        27 rundll32.exe 21->27         started        38 6685a7f6.app.giftbox4u.com 23->38 40 481fb7b2.store.giftbox4u.com 23->40 44 7 other IPs or domains 23->44 30 explorer.exe 23->30         started        signatures7 process8 dnsIp9 52 3d1eaef2.cdn.giftbox4u.com 27->52 55 3d1eaef2.store.giftbox4u.com 27->55 57 6 other IPs or domains 27->57 32 explorer.exe 1 27->32         started        signatures10 73 System process connects to network (likely due to code injection or exploit) 52->73 75 Rundll32 performs DNS lookup (likely malicious behavior) 55->75 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/336bd53861dfdcb433486bc852127c77ccc3234de79582b39639d2aacf5fd2aa/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-06-01 23:47:09 UTC
AV detection:
13 of 47 (27.66%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
35b6d770bb5d9cdf686f07226c67de969c21648af598ee58036383a606802327
CobaltStrike
3cd9b8f675d4718c4d73a9b1656836790a058b8ba46c1e0f254d46775ab06556
CobaltStrike
4221a58582224362249f41a07918015a730a2ef93050dc25f585cc9498095667
CobaltStrike
65d5e3d6f233a393e6c4d11fa947f733f3109e005cc1f957abe2ab8d78dc6002
CobaltStrike
6aa7014299e01ce49789a7525d0eb3d4d685c220cae8ed4a6fa135c10d327762
CobaltStrike
7f3c8bf4b5d1cc28beaf09f5f31b8fad2d353b12484185097fdf8bf86fc55e30
CobaltStrike
8af8a2aa6d8db7a9bf93620814017b5296713963b74aba38eb7a35e62dcb7d3e
CobaltStrike
ba1e40a772acdd71dc1e47b4f9ab2767868fd959f072a55c00da383a590c160f
CobaltStrike
cc2c6d177b60a3ec0aec1d38ba1f7942293ac85e688182f545720a952b511a97
CobaltStrike
f7eda7111ac0f95dfbd817bd0962defe35412de12964f178421122e96c72495b
CobaltStrike
+ 276 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:1359593325 backdoor trojan
Link:
https://tria.ge/reports/210601-ag8jvhsyen/
Behaviour
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Cobaltstrike
Malware Config
C2 Extraction:
http://app.giftbox4u.com:53/jquery-3.3.1.min.js
http://cdn.giftbox4u.com:53/jquery-3.3.1.min.js
http://dns.giftbox4u.com:53/jquery-3.3.1.min.js
http://store.giftbox4u.com:53/jquery-3.3.1.min.js
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/336bd53861dfdcb433486bc852127c77ccc3234de79582b39639d2aacf5fd2aa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/163902/

Comments