MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 492dedfe1a550c4786e5e58435b9f385a415ec4704e008ab0343f006a8ce00da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 492dedfe1a550c4786e5e58435b9f385a415ec4704e008ab0343f006a8ce00da
SHA3-384 hash: 46dbddd8650170fff396d553730e7d67971ecb82fbeae6621cc9c76b00d113b0621a004dc34c52818662b9c22e4c1f49
SHA1 hash: 58c405e7de981ce2bf8717794c25f2e409a2592b
MD5 hash: 9c1460c8cbed72898e53b7bd64329c39
humanhash: kitten-wisconsin-high-artist
File name:492dedfe1a550c4786e5e58435b9f385a415ec4704e008ab0343f006a8ce00da
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:260'608 bytes
First seen:2020-10-24 21:20:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 39a613f0d59cc3ef3bbadfe701521e7c (128 x CobaltStrike)
ssdeep 3072:mJwpS2NACV4qAbypuljJGnJYoTjqETdtbsnOfFwXVa/o494YJGaXMXhwHnaH:mJwpYVNcn3pTdNe+WXVin4utH
Threatray 28 similar samples on MalwareBazaar
TLSH 2F445A4532A03DF5ECA7D67ACA534616EFF2BC624630D71F03641A5B0F273A1A22E752
Reporter seifreed
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/75281/
Detection(s):
Win.Tool.Razy-9778192-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/508790
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 303512 Sample: yojpz9c13Z Startdate: 24/10/2020 Architecture: WINDOWS Score: 60 15 Antivirus / Scanner detection for submitted sample 2->15 17 Multi AV Scanner detection for submitted file 2->17 19 Machine Learning detection for sample 2->19 7 loaddll64.exe 1 2->7         started        process3 process4 9 rundll32.exe 7->9         started        11 rundll32.exe 7->11         started        process5 13 WerFault.exe 17 9 9->13         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/492dedfe1a550c4786e5e58435b9f385a415ec4704e008ab0343f006a8ce00da/
Threat name:
Win64.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2020-06-26 08:56:01 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jew637q2kugepbxf4wcdloptqwsbl3chatqarkydipyankgoadna._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
129aefff5a7c2da45e7c0afe8bfbe3a16c437328ee569640d0c90a7c91de0dd7
CobaltStrike
15073e335455478c4bf28954f35f6ab8f692527786b3d4436acb0e55097bb952
CobaltStrike
39a7738c00d6a5dcc4709ad2e3f0b57565f7dc0325bdb5942c3e696c5736bc5a
CobaltStrike
9c3b7ba8d375f19993312a6ac20418e0d107d73b30d585e9ad3646e150ff7c5a
CobaltStrike
a1d9d1784959597859b70af8479ecb3a5eb577be1bcf10dc2b57fd7beb3ba874
CobaltStrike
c380f48e3d649b6a44b05134108a8c79536f289240e9ed9135e35dadffb6c350
CobaltStrike
cca380d18764adc6589cb94018c7a3cec6daa125c2909dd26a531c448501c8dc
CobaltStrike
ec2f156359e30aaf1929dff8f4b97deba32fe642d7fb8a76ba2346605c2d94d0
CobaltStrike
f4d129a8289b89a4a8d385d89702bae3c7b5fcf9d32c3b1eee61bc0245bfb99a
CobaltStrike
ffeab3a518bf3b9216d7a23d2ac471aa4cc9f2f45571d32677b5ef5b8d6a6ee1
CobaltStrike
+ 18 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/201024-94ljh3tlyj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Malware Config
C2 Extraction:
http://67.207.93.135:80/metro91/admin/1/ppptp.jpg
Unpacked files
SH256 hash:
492dedfe1a550c4786e5e58435b9f385a415ec4704e008ab0343f006a8ce00da
MD5 hash:
9c1460c8cbed72898e53b7bd64329c39
SHA1 hash:
58c405e7de981ce2bf8717794c25f2e409a2592b
Detections:
win_cobalt_strike_auto
Create hunting rule
Link:
https://www.unpac.me/results/c1105b65-d210-4afc-96ce-09b7e51959d4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Swrort
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/492dedfe1a550c4786e5e58435b9f385a415ec4704e008ab0343f006a8ce00da

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALW_cobaltrike
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect CobaltStrike beacon
Rule name:win_cobalt_strike_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/75281/

Comments