MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44d961f8647d856ae040bf6c7797f1edee4712a1af7396776560f2aeafea6434. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44d961f8647d856ae040bf6c7797f1edee4712a1af7396776560f2aeafea6434
SHA3-384 hash: 74a46d995af3864d915da1cfc33639b18351a372284fb081996c33c34d053928e22c8135f630ed51af795473ef41d717
SHA1 hash: 8352cda852c7d9d2149a38ea3c47d8065b02b108
MD5 hash: 2507254d81da75f3c5840e9ecd418615
humanhash: west-mobile-coffee-four
File name:44d961f8647d856ae040bf6c7797f1edee4712a1af7396776560f2aeafea6434
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:3'659'575 bytes
First seen:2020-09-08 12:17:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f9d4e4402b24826f24da78ca7ab0442f (2 x CobaltStrike)
ssdeep 98304:aMQIkz7Dv4phqvBfmhwnJB6Fi4CnotnbtFWbFs:aLI3hqv1bn3GvVBt
TLSH E806335A339044B9C42186349AF2C02A433778362BA0DFDD57D8CB933FA77A57D29E16
Reporter JAMESWT_WT
Tags:47.240.45.183 CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/57877/
Detection(s):
SecuriteInfo.com.Mal.Veil-A.16206.20482.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Connection attempt
Launching the default Windows debugger (dwwin.exe)
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/44d961f8647d856ae040bf6c7797f1edee4712a1af7396776560f2aeafea6434/
Threat name:
Win64.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-03-30 02:39:50 UTC
File Type:
PE+ (Exe)
Extracted files:
213
AV detection:
9 of 29 (31.03%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=itmwd6depwcwvycax5whpf7r5xxeoevbv5zzm53fmdzk5l7kmq2a._file
Result
Malware family:
metasploit
Create hunting rule
Score:
  10/10
Tags:
trojan backdoor family:metasploit
Link:
https://tria.ge/reports/200908-v88j1hq3ce/
Behaviour
Suspicious use of WriteProcessMemory
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
JavaScript code in executable
JavaScript code in executable
Loads dropped DLL
Loads dropped DLL
ServiceHost packer
MetaSploit
Suspicious use of NtCreateProcessExOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/44d961f8647d856ae040bf6c7797f1edee4712a1af7396776560f2aeafea6434

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.
Rule name:WinPayloads_Payload
Create hunting rule
Author:Florian Roth
Description:Detects WinPayloads Payload
Reference:https://github.com/nccgroup/Winpayloads

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/malwrhunterteam/status/1303301068730834945?s=20
Cape
Cape
https://www.capesandbox.com/analysis/57877/

Comments