MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46196f889bde8f7d74dab2eda145215ac33eb4451aab8705d71bd6ea3c20988c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 14


Intelligence 14 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46196f889bde8f7d74dab2eda145215ac33eb4451aab8705d71bd6ea3c20988c
SHA3-384 hash: f2002ff94e252a7cd73d52198c704aec50613029a31e4eadd107a6af06b9bddfc62ac6ed6475a133bd203c96b9dd4bc1
SHA1 hash: 310ade16a531c195a1db4a84968fb935f7ba5bd1
MD5 hash: dfccd2b074d6380a61e70fa743f64d9d
humanhash: avocado-jupiter-enemy-wisconsin
File name:tufaqixiang666.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:23'040 bytes
First seen:2025-11-30 19:34:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 20662f6d8d201a1288617fb796340672 (1 x CobaltStrike)
ssdeep 192:qkRMw9ZO7tol6uouB9j4CWvKhkX6GgBzh+ErA8lxk3Q5tfL3+umf:h9ZO7SHouB9jovKhUIbi3OOl
Threatray 15 similar samples on MalwareBazaar
TLSH T13FA24941FB860DFDEB2402F2C033421AE0B6BE39176186CB0B79B1192D7279165763CD
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter GDHJDSYDH1
Tags:backdoor CobaltStrike exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
141
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
tufaqixiang666.exe
Verdict:
No threats detected
Analysis date:
2025-11-30 19:31:22 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c1c015ea-9477-46b9-a621-c911418f221c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/41956/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=692c9b8ac908fdc6974711a6
Tags:
cobaltstrike cobalt
Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sending an HTTP GET request
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
anti-vm microsoft_visual_cc
Link:
https://www.filescan.io/uploads/692c9c3606363f28214fe4d5/reports/7e396239-dac2-4205-a549-6f448f7a7707/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/46196f889bde8f7d74dab2eda145215ac33eb4451aab8705d71bd6ea3c20988c
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-11-30T14:05:00Z UTC
Last seen:
2025-12-01T13:02:00Z UTC
Hits:
~100
Detections:
UDS:DangerousObject.Multi.Generic Trojan.Win32.Shelma.a Trojan.Win32.CobaltStrike.lzs Trojan.Cobalt.HTTP.C&C Trojan.Win64.Cobalt.sb Trojan.CobaltStrike.HTTP.C&C Trojan.Agent.HTTP.C&C Trojan.Win64.Shlem.sb Trojan.Win64.Shelm.sb Trojan.Win32.Shelm.a Trojan.Win32.CobaltStrike.sb Trojan.Win32.CobaltStrike.mz HEUR:Trojan.Script.CobaltStrike.gen
Link:
https://opentip.kaspersky.com/46196f889bde8f7d74dab2eda145215ac33eb4451aab8705d71bd6ea3c20988c/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/fe73031b-78f3-437f-9c8a-d27be97a096f
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/46196f889bde8f7d74dab2eda145215ac33eb4451aab8705d71bd6ea3c20988c
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/dfccd2b074d6380a61e70fa743f64d9d
Detection:
cobaltstrike
Create hunting rule
Link:
https://mwdb.cert.pl/sample/46196f889bde8f7d74dab2eda145215ac33eb4451aab8705d71bd6ea3c20988c/
Verdict:
Malicious
Threat:
Trojan.Win32.CobaltStrike
Link:
https://tip.neiki.dev/file/46196f889bde8f7d74dab2eda145215ac33eb4451aab8705d71bd6ea3c20988c
Threat name:
Win64.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-11-30 19:31:23 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
18 of 24 (75.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iymw7ce332hx25g2wlw2crjbllbt5ncfdkvyoboxdploupbatcga._file
Verdict:
malicious
Label(s):
metasploit
Create hunting rule
cobaltstrike
Create hunting rule
Similar samples:
46196f889bde8f7d74dab2eda145215ac33eb4451aab8705d71bd6ea3c20988c
CobaltStrike
4c7dab2b02e95713227c4d42a450fb49611abc565f18fd986b80bd4f9c83d693
CobaltStrike
5bcef00c270c39cbe34fab65226ca6e442e99dc4e0d42e6a5c1039c105ffa95f
CobaltStrike
64db468d9c3d860ef9f014b1b7020a1089249eb169220cc3bd3018f232b992aa
CobaltStrike
9051482fcb1ac6c9f2c06d74ba2f1f964f35bdfd1a046be05b6f69e47ad84aa8
CobaltStrike
error
CobaltStrike
fcf2dfb4bbc60cfcf233616f5b995859d233dc46c108bbce16c49dec186e6416
CobaltStrike
+ 5 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251130-x965maxpcw/
Verdict:
Suspicious
Tags:
Cobalt_Strike
YARA:
n/a
Link:
https://app.threat.zone/submission/c12349e9-3565-4b35-9c4e-b03688d4c82a
Unpacked files
SH256 hash:
46196f889bde8f7d74dab2eda145215ac33eb4451aab8705d71bd6ea3c20988c
MD5 hash:
dfccd2b074d6380a61e70fa743f64d9d
SHA1 hash:
310ade16a531c195a1db4a84968fb935f7ba5bd1
Link:
https://www.unpac.me/results/2b0e804a-3b3d-4710-8d32-2c66523cbe11/
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/46196f889bde/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/46196f889bde8f7d74dab2eda145215ac33eb4451aab8705d71bd6ea3c20988c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobaltbaltstrike_Beacon_x64
Create hunting rule
Author:Avast Threat Intel Team
Description:Detects CobaltStrike payloads
Reference:https://github.com/avast/ioc
Rule name:CobaltStrikeBeacon
Create hunting rule
Author:ditekshen, enzo & Elastic
Description:Cobalt Strike Beacon Payload
Rule name:CobaltStrike_C2_Encoded_XOR_Config_Indicator
Create hunting rule
Author:yara@s3c.za.net
Description:Detects CobaltStrike C2 encoded profile configuration
Rule name:CobaltStrike_MZ_Launcher
Create hunting rule
Author:yara@s3c.za.net
Description:Detects CobaltStrike MZ header ReflectiveLoader launcher
Rule name:CobaltStrike_Sleeve_BeaconLoader_VA_x64_o_v4_3_v4_4_v4_5_and_v4_6
Create hunting rule
Author:gssincla@google.com
Description:Cobalt Strike's sleeve/BeaconLoader.VA.x64.o (VirtualAlloc) Versions 4.3 through at least 4.6
Reference:https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse
Rule name:CobaltStrike__Sleeve_BeaconLoader_VA_x64_o_v4_3_v4_4_v4_5_and_v4_6
Create hunting rule
Author:gssincla@google.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:HKTL_CobaltStrike_Beacon_Strings
Create hunting rule
Author:Elastic
Description:Identifies strings used in Cobalt Strike Beacon DLL
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_Win_CobaltStrike
Create hunting rule
Author:threatintel@volexity.com
Description:The CobaltStrike malware family.
Reference:https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
Rule name:malware_CobaltStrike_v3v4
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect CobaltStrike Beacon in memory
Reference:https://blogs.jpcert.or.jp/en/2018/08/volatility-plugin-for-detecting-cobalt-strike-beacon.html
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:SUSP_XORed_Mozilla_Oct19
Create hunting rule
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:Windows_Trojan_CobaltStrike_1787eef5
Create hunting rule
Author:Elastic Security
Description:CS shellcode variants
Rule name:Windows_Trojan_CobaltStrike_3dc22d14
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_CobaltStrike_f0b627fc
Create hunting rule
Description:Rule for beacon reflective loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CobaltStrike

Executable exe 46196f889bde8f7d74dab2eda145215ac33eb4451aab8705d71bd6ea3c20988c

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/41956/

Comments