🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a76ffcf4a09876d6cc13769e152457d266dc5d55dd2333a3db4bb12e895de24. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Cobalt Strike


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a76ffcf4a09876d6cc13769e152457d266dc5d55dd2333a3db4bb12e895de24
SHA3-384 hash: 3a789f1508a6e7f1dde35e7e6596527d9afe16df31fc803d05006f3c9333505d88e5dacbaea6f0c7fbdadffbe6ffaacf
SHA1 hash: eb456d6f4e2fbb5d804adf914114b8224a0a7583
MD5 hash: 038bd62710ad3678adc03722b3413176
humanhash: stream-leopard-texas-oregon
File name:443_2003_psh_x86.ps1
Download: download sample
Signature Cobalt Strike
Create hunting rule
File size:3'687 bytes
First seen:2025-03-13 08:47:45 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 48:w+MThimb7RunK/jPEDfAsxjjy5H71EbhXI3FD1Buv/41:zGT8gPEDfXUcVXIVMQ1
Threatray 121 similar samples on MalwareBazaar
TLSH T1EE717B523093F08F008647793A9823E6947AD604DADE6109B78CEFBDB9DDD633A4D6C4
Magika powershell
Reporter Joker
Tags:Cobalt Strike malware Meterpreter ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
436
Origin country :
NL NL
Vendor Threat Intelligence
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67d29d183962f1a6f470bcf4
Tags:
shell virus sage
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/67d29bcd4a3011c802cf51e2/reports/2e0b8c7e-c1c6-492b-bc55-442e3bce0009/overview
Verdict:
Malicious
Labled as:
Powershell.Injector.B.Generic
Link:
https://www.hybrid-analysis.com/sample/3a76ffcf4a09876d6cc13769e152457d266dc5d55dd2333a3db4bb12e895de24
Result
Threat name:
Metasploit
Create hunting rule
Detection:
malicious
Classification:
troj.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1636983
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Found malware configuration
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Dot net compiler compiles file from suspicious location
Yara detected Metasploit Payload
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1636983 Sample: 443_2003_psh_x86.ps1 Startdate: 13/03/2025 Architecture: WINDOWS Score: 100 23 Found malware configuration 2->23 25 Malicious sample detected (through community Yara rule) 2->25 27 Antivirus detection for dropped file 2->27 29 6 other signatures 2->29 7 powershell.exe 26 2->7         started        10 notepad.exe 5 2->10         started        process3 file4 19 C:\Users\user\AppData\...\ihfxlaxl.cmdline, Unicode 7->19 dropped 12 csc.exe 3 7->12         started        15 conhost.exe 7->15         started        process5 file6 21 C:\Users\user\AppData\Local\...\ihfxlaxl.dll, PE32 12->21 dropped 17 cvtres.exe 1 12->17         started        process7
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3a76ffcf4a09876d6cc13769e152457d266dc5d55dd2333a3db4bb12e895de24
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a76ffcf4a09876d6cc13769e152457d266dc5d55dd2333a3db4bb12e895de24/
Threat name:
Script-PowerShell.Trojan.MPreter
Create hunting rule
Status:
Malicious
First seen:
2025-03-13 08:48:10 UTC
File Type:
Text (PowerShell)
AV detection:
22 of 38 (57.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hj3p7t2kbgdw23gbg5u6cusfputg3rovlxjdgor5ws5rf2ev3ysa._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
2b6648a967faf8eba2dd9983cd029e7bd06c20fc1afcac11a6987eda4e53288e
Cobalt Strike
344f75284c6d532913c6262065be8116f451ac61720ea3cf141eef8dac98970b
Cobalt Strike
504f427ff87c3d99091d5264dd31d896750fa40420ce5dd7658a4422da3f57d8
Cobalt Strike
5f4740ee065cca602b02be671fb078b63bb5fe2f733614c7207a87ab9b9454dd
Cobalt Strike
8456cbb869c382a7d7454a2493d571a6d836559c7e406c67a81e29713f14ca5d
Cobalt Strike
9d5e06da22a3c8b527516187f7753ee43a4929465d2c6ca58de0851323c44aa8
Cobalt Strike
deb84651d478f464d0039593edbc7b955ae049d6e1513a31ae98723840cbe766
Cobalt Strike
error
Cobalt Strike
faf6a88f7009bcb34f39ca11e7b1968b9666ee10609ad49ba8cf32e36c2ad397
Cobalt Strike
+ 111 additional samples on MalwareBazaar
Result
Malware family:
metasploit
Create hunting rule
Score:
  10/10
Tags:
family:metasploit backdoor execution trojan
Link:
https://tria.ge/reports/250313-kqhxgaspz7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
MetaSploit
Metasploit family
Malware Config
C2 Extraction:
http://192.168.45.195:2003/9fp0cuD8jdgZCxgKfqgcxwKaWZlgArnOIAVnWkBzkk1e9752B4rrqs3Up3d8UwTPBmdUp6CYZzx7hiuSs-EJr4k8ev
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.70
Link:
https://yomi.yoroi.company/submissions/3a76ffcf4a09876d6cc13769e152457d266dc5d55dd2333a3db4bb12e895de24

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments