MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40ab463703114d972269c34abeecf0f796c88c20cceaaf0e582ed0a132e556fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	40ab463703114d972269c34abeecf0f796c88c20cceaaf0e582ed0a132e556fa
SHA3-384 hash:	6a612f24e348be076f611e102cbf9ee6626339c998bae526918bf8f12a3ba4b5fe0f261958f710ee4b49157d1002ce93
SHA1 hash:	4bf7ed198da315016f0759dee4c5705f1cd465f0
MD5 hash:	1cb5a9c2bc4adfe101f6069d525ba9b2
humanhash:	gee-nebraska-lake-london
File name:	aloy64.exe
Download:	download sample
Signature	CobaltStrike Alert Create hunting rule
File size:	396'288 bytes
First seen:	2022-12-08 19:10:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	a35f121ed76d9b1e75ce64250798b7ea (1 x CobaltStrike)
ssdeep	6144:fduncjk3xxCY3Z57rsM/f+xpnW3IpULzArfC43Qp951nHhZW4oI29NyA6xUjqQ43:f1jkRLsGGxpnWjL8G4qot9NGxUjqQ4L
TLSH	T19E84CF15F2910DDBCCA7863D4862021ABB313C560726CFBBA290C73A3E577D59E76B21
TrID	48.7% (.EXE) Win64 Executable (generic) (10523/12/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter	malware_traffic
Tags:	64bit Beacon Cobalt Strike CobaltStrike exe

malware_traffic

Seen as follow-up malware after an IcedID infection on 2022-12-08

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

295

Origin country :

US

Vendor Threat Intelligence

CAPE Sandbox CobaltStrikeBeacon

Detection:

CobaltStrikeBeacon

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/344459/

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

DNS request

Sending a custom TCP request

Sending an HTTP GET request

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/639236c755eb3470cd4ff758/reports/4d361ff6-a778-42c7-9f16-f295cd6e2b67/overview

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Cobalt Strike

Malware family:

Cobalt Strike

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d166e324-4ad8-4ed8-811d-69b64f2e6fac

Joe Sandbox CobaltStrike

Result

Threat name:

CobaltStrike

Alert

Create hunting rule

Detection:

malicious

Classification:

troj

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1130986

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/40ab463703114d972269c34abeecf0f796c88c20cceaaf0e582ed0a132e556fa/

ReversingLabs TitaniumCloud Win64.Trojan.CobaltStrike

Threat name:

Win64.Trojan.CobaltStrike

Alert

Create hunting rule

Status:

Malicious

First seen:

2022-12-08 20:06:48 UTC

AV detection:

15 of 26 (57.69%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=icvumnydcfgzoitjynfl53hq66lmrdbaztvk6dsyf3ikcmxfk35a._file

Hatching Triage cobaltstrike

Result

Malware family:

cobaltstrike

Alert

Create hunting rule

Score:

  10/10

Tags:

family:cobaltstrike botnet:0 botnet:666 backdoor trojan

Link:

https://tria.ge/reports/221208-xvxyeaba76/

Behaviour

Modifies system certificate store

Cobaltstrike

Malware Config

C2 Extraction:

http://aloyadakmashin.com:443/wp-content/chunky/

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/f280b070-e19e-4b3f-859b-c84f871eb331

UnpacMe

Unpacked files

SH256 hash:

40ab463703114d972269c34abeecf0f796c88c20cceaaf0e582ed0a132e556fa

MD5 hash:

1cb5a9c2bc4adfe101f6069d525ba9b2

SHA1 hash:

4bf7ed198da315016f0759dee4c5705f1cd465f0

Link:

https://www.unpac.me/results/45e3cec3-de7a-440e-8c62-49264c32fa33/

VMRay CobaltStrike

Malware family:

CobaltStrike

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/40ab46370311/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/40ab463703114d972269c34abeecf0f796c88c20cceaaf0e582ed0a132e556fa

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

  

Delivery method

Other

Cape

https://www.capesandbox.com/analysis/344459/