MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e895013e36b5d95cac2afc77745b118406219e530a714afc95c91f26f4a3956. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e895013e36b5d95cac2afc77745b118406219e530a714afc95c91f26f4a3956
SHA3-384 hash: 536a97752c5b3ad87edbedb3f4096f8eeb2b8e51cd149e028e777772862ac0e88b1b9b5c82b38f7cc543891cb05d2920
SHA1 hash: 46e7bf07c4be5a33d304de9ec88b487133cc5722
MD5 hash: 973db8341e2f1588523b91de22cd432e
humanhash: purple-xray-west-romeo
File name:3e895013e36b5d95cac2afc77745b118406219e530a714afc95c91f26f4a3956
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:14'336 bytes
First seen:2020-09-04 08:54:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash dc25ee78e2ef4d36faa0badf1e7461c9 (118 x CobaltStrike, 5 x Cobalt Strike)
ssdeep 192:THCugRK83SxHn2OQ/dmBI4KBPwgir+xz+bqUqV/Qjo7AGa:jCxRKqbOCdWIVBPk+xzafCXAn
TLSH 7B521A75EA4378F2FD1A897014EBB6FFAEB3E2134C105C86CF94ED0159238B6980664D
Reporter JAMESWT_WT
Tags:212.64.87.3 CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/55655/
Detection(s):
Win.Trojan.CobaltStrike-7899872-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3e895013e36b5d95cac2afc77745b118406219e530a714afc95c91f26f4a3956/
Threat name:
Win32.Trojan.Cobalt
Create hunting rule
Status:
Malicious
First seen:
2020-08-21 16:18:00 UTC
File Type:
PE (Exe)
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Result
Malware family:
metasploit
Create hunting rule
Score:
  10/10
Tags:
trojan backdoor family:metasploit
Link:
https://tria.ge/reports/200904-9pakgbafy6/
Behaviour
MetaSploit
Malware Config
C2 Extraction:
http://212.64.87.3:80/H6dz
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Diple
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3e895013e36b5d95cac2afc77745b118406219e530a714afc95c91f26f4a3956

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/malwrhunterteam/status/1301803989353324544?s=20
Cape
Cape
https://www.capesandbox.com/analysis/55655/

Comments