MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 356bef23d9b91f713fd54e5bef83bf738e869ca51324b580aed0d649bfdefea3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 8


Intelligence 8 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 356bef23d9b91f713fd54e5bef83bf738e869ca51324b580aed0d649bfdefea3
SHA3-384 hash: 7ae4780e5334136ae9a98d2ac2f69569bc3c306da4b10ceb781cefc92a60553f4e2085c3cf06004f4de6ab47081fbc9f
SHA1 hash: b132238e1119ddfbebbdb36d61a126a06962671d
MD5 hash: 94b985295af69e2bd6d26eb5273538f0
humanhash: nineteen-hotel-diet-texas
File name:beacon.ps1
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:352'571 bytes
First seen:2022-08-03 06:18:57 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 6144:pbCjcsg8y7zWnBDNyGzj++6USqvoPrEBrtWeenmN0ZqnbdC1Kd2kdXsGlmJ9lFSr:pbC4sXyvWdT++eqvoQBrddokdX/G4
Threatray 283 similar samples on MalwareBazaar
TLSH T1A5745A473F5969EEE212F527E63DB0C225E0752E90A98AD4B7F1D4B118F802234F47A7
Reporter JAMESWT_WT
Tags:CobaltStrike ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
623
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.CobaltStrike-7917400-0
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cobalt evasive greyware mask metasploit meterpreter obfuscated powershell reflection rozena
Link:
https://www.filescan.io/uploads/62ea13ceb7eec65627875109/reports/e3fb7002-dbdb-4b46-9d19-6c08cdb61061/overview
Result
Verdict:
MALICIOUS
Result
Threat name:
CobaltStrike, Metasploit
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1045390
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Yara detected MetasploitPayload
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/356bef23d9b91f713fd54e5bef83bf738e869ca51324b580aed0d649bfdefea3/
Threat name:
Script-PowerShell.Backdoor.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2022-07-30 17:01:27 UTC
File Type:
Text (PowerShell)
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gvv66i6zxepxcp6vjzn67a57oohinhffcmsllafo2dletp6672rq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
1b779efc0b5b86952f7ff7ee3d6fd72c1a7b941f5a55641c72ca7dbd18f250ae
CobaltStrike
2fe7b81253f7726822e0f6ff1a3bacea73ca2356ca4dcb460493586629961ad0
CobaltStrike
7ef462d0e35aeaf45b5cac05f2ee8b5522fa8e3a3bbbbf6b00c3ac1cd2eb3c16
CobaltStrike
a55dbb26705b65000f18861cc6878dd5b95288f43b2b7a18c1a5131279bfa9b2
CobaltStrike
b107545a730cd8a999d58daac31c59e20c12219c7d999ad05987c5cae0602851
CobaltStrike
d3c07ceb0ca4710adc66bee177fd0ec160b14b4c7c059e680ab4324b455bb08d
CobaltStrike
e65e6051980701ae9bcd600fd08c7be44f8f299c8ad68d8cbddf704f9757c870
CobaltStrike
+ 273 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:0 backdoor trojan
Link:
https://tria.ge/reports/220803-g26wwsfhf2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Blocklisted process makes network request
Cobaltstrike
Malware Config
C2 Extraction:
http://78.85.17.88:6001/ga.js
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.15
Link:
https://yomi.yoroi.company/submissions/356bef23d9b91f713fd54e5bef83bf738e869ca51324b580aed0d649bfdefea3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:Cobaltbaltstrike_Beacon_Encoded
Create hunting rule
Author:Avast Threat Intel Team
Description:Detects CobaltStrike payloads
Reference:https://github.com/avast/ioc
Rule name:Msfpayloads_msf_ref
Create hunting rule
Author:Florian Roth
Description:Metasploit Payloads - file msf-ref.ps1
Reference:Internal Research
Rule name:Msfpayloads_msf_ref_RID2ED5
Create hunting rule
Author:Florian Roth
Description:Metasploit Payloads - file msf-ref.ps1
Reference:Internal Research
Rule name:SUSP_PowerShell_Base64_Decode
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects PowerShell code to decode Base64 data. This can yield many FP

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments