MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4109d17d439e425d24e9d11956adcc63ff8e24ccfffe21dd8c5431fe969d2783. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4109d17d439e425d24e9d11956adcc63ff8e24ccfffe21dd8c5431fe969d2783
SHA3-384 hash: f24a5fc5a5fc7fe3c14023f24bd8a19e16d7ba2b814726f0a73d05c45a3e5e6652b23bf9de6d67889b6bafbf42ca7842
SHA1 hash: fdecb788ba7cd9c855686b0598d4953af85ab399
MD5 hash: 471601a24b16ed8f14f68967eac8d64e
humanhash: chicken-fruit-indigo-red
File name:favicon
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:195'252 bytes
First seen:2022-07-01 08:47:21 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 3072:e/pd7wTQmSxIZ9uflCg5Ac45uiRm4zakF2FtsuvJfOJ3RCXWh5qGdJESw5f2X:eRQh9alCcfy5akFYLRfOJ3RCG/SF2X
TLSH T11814126808CCB97BFE04ECE01A973D0AAB7EA7E018CB09A7CA7553CE402B615164B517
Reporter JAMESWT_WT
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
711
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Meterpreter-7385375-0
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/62beb500b0578633c8b7aaae/reports/88d8f136-0751-4664-8c05-6109d8f656b2/overview
Result
Verdict:
MALICIOUS
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1023154
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4109d17d439e425d24e9d11956adcc63ff8e24ccfffe21dd8c5431fe969d2783/
Threat name:
Script-PowerShell.Hacktool.PowerSploit
Create hunting rule
Status:
Malicious
First seen:
2022-07-01 08:48:05 UTC
File Type:
Text (PowerShell)
AV detection:
23 of 40 (57.50%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iee5c7kdtzbf2jhj2emvnlommp7y4jgm777cdxmmkqy75fu5e6bq._file
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:520 backdoor suricata trojan
Link:
https://tria.ge/reports/220701-ltb4rscdfq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Blocklisted process makes network request
Cobaltstrike
suricata: ET MALWARE Cobalt Strike Beacon Observed
suricata: ET MALWARE Meterpreter or Other Reverse Shell SSL Cert
Malware Config
C2 Extraction:
http://120.48.85.228:443/cm
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4109d17d439e425d24e9d11956adcc63ff8e24ccfffe21dd8c5431fe969d2783

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:SUSP_PS1_FromBase64String_Content_Indicator
Create hunting rule
Author:Florian Roth
Description:Detects suspicious base64 encoded PowerShell expressions
Reference:https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639
Rule name:SUSP_PS1_FromBase64String_Content_Indicator_RID3714
Create hunting rule
Author:Florian Roth
Description:Detects suspicious base64 encoded PowerShell expressions
Reference:https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/malwrhunterteam/status/1542790112244817920?s=20&t=b4thrKY9qdj0lhYGVuBa7g

Comments