MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35e5460c102ca2f996d61d70d6bb06fb87014f7d2beccf35f3812ea534acd9d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CobaltStrike

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	35e5460c102ca2f996d61d70d6bb06fb87014f7d2beccf35f3812ea534acd9d5
SHA3-384 hash:	a3a41cbd672ff9190d5a2ea613ed6adeb25b8917c1bcb6b5f118be4d2c1d63a6e24c7e639da4a4dae412261d30888126
SHA1 hash:	e950cc66152aa2539f6d57a506abc40263f34297
MD5 hash:	13edc9e053cfe10575e779d4e048af5b
humanhash:	yellow-rugby-michigan-july
File name:	薪资补贴填写模板.exe
Download:	download sample
Signature	CobaltStrike Create hunting rule
File size:	3'963'014 bytes
First seen:	2023-04-17 00:38:45 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	aac51396886833dc961fcd7aab7711e4 (11 x NetSupport, 7 x DCRat, 4 x njrat)
ssdeep	98304:PJydxM02SoemiJC45AGqybV8k4mh4YNrg8xubmKyHx:Ude02SZRC4G6Z8k4OTNbxumKa
Threatray	8 similar samples on MalwareBazaar
TLSH	T1F1063311B2C199F1C52314324B2ADF20E57AFD322B6A69E7E3847A1FED311D093357A6
TrID	40.3% (.EXE) Win64 Executable (generic) (10523/12/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4505/5/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):
dhash icon	9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter	sicehicetf
Tags:	Cobalt Strike CobaltStrike exe

sicehice

#opendir hosting a #cobaltstrike stager

216.240.140[.]185:8000

薪资补贴填写模板.exe connects to 121.43.108[.]230 (C2 known since 2021)
MD5: 13edc9e053cfe10575e779d4e048af5b

Intelligence

File Origin

# of uploads :

# of downloads :

859

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

薪资补贴填写模板.exe

Verdict:

Malicious activity

Analysis date:

2023-04-17 00:11:34 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/1a6581b6-5c60-4e8b-934e-7f1e01cdcf2e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.GenericKDZ.95079.13978.16144.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the Windows subdirectories

Creating a process from a recently created file

Launching the default Windows debugger (dwwin.exe)

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm greyware overlay packed packed setupapi.dll shdocvw.dll shell32.dll spyeye stealer

Link:

https://www.filescan.io/uploads/643c9527b197bbdcf7dc23ad/reports/f05b0127-e553-4e08-96da-fb5adf9b811f/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/35e5460c102ca2f996d61d70d6bb06fb87014f7d2beccf35f3812ea534acd9d5

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/3e86c6c7-3ac7-496c-a636-48394f3ae102

Result

Threat name:

CobaltStrike

Detection:

malicious

Classification:

troj.evad

Score:

69 / 100

Link:

https://www.joesandbox.com/analysis/1214919

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/35e5460c102ca2f996d61d70d6bb06fb87014f7d2beccf35f3812ea534acd9d5/

Threat name:

Win32.Trojan.Rozena

Status:

Malicious

First seen:

2023-04-17 00:39:20 UTC

File Type:

PE (Exe)

Extracted files:

728

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gxsumdaqfsrptfwwdvynnoyg7odqct35fpwm6nptqexkknfm3hkq._file

Verdict:

malicious

Label(s):

cobaltstrike

CobaltStrike

18ab5e7a8a16ee97cfaf8d710e023a7816f0e0c6e57c1d6ca2f9ca311db0dd12

CobaltStrike

2c66b37d72afdca33b587fcb09b635d4691d832de02f0423053ade3da69242a8

CobaltStrike

43d1c7d70506db33b4db5a3f27582e1f1493b69b6d2493756c88f550529ca969

CobaltStrike

54a9e7cbf35f159c8704b395a519421c8173ffcc5585b3c397760e54fcbaa096

CobaltStrike

a2ddb2901e7b54c98ad8eb17a8b2a019b344a8c459aa15b29b4fda8962931486

CobaltStrike

d102af126bcff04b5b089f3872b3add0fef3e755eea0182e8f28324b3c5dcc5f

CobaltStrike

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/230417-azma5sec3w/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Unpacked files

SH256 hash:

35e5460c102ca2f996d61d70d6bb06fb87014f7d2beccf35f3812ea534acd9d5

MD5 hash:

13edc9e053cfe10575e779d4e048af5b

SHA1 hash:

e950cc66152aa2539f6d57a506abc40263f34297

Link:

https://www.unpac.me/results/e6bd21d8-5a53-4943-b520-f717934af121/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/35e5460c102ca2f996d61d70d6bb06fb87014f7d2beccf35f3812ea534acd9d5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.