MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f10105c7b47462521f6e0e82d79cd17a084e786270fb529919f56c3d46d5152. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 12


Intelligence 12 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f10105c7b47462521f6e0e82d79cd17a084e786270fb529919f56c3d46d5152
SHA3-384 hash: ce0077d34edf84165e7a9e842b4ef98f9cd90ffa98931f0b6f336a20becc0d500687202b55659e1cd46a6c4b22ba6d12
SHA1 hash: 932059d0906948149c65376bc72a8faaf51128a8
MD5 hash: 38be4a6130198e4378e8a931687893f9
humanhash: four-fruit-washington-carolina
File name:cs.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:224'256 bytes
First seen:2021-11-04 21:53:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 829da329ce140d873b4a8bde2cbfaa7e (259 x CobaltStrike)
ssdeep 6144:Up6nub9W2wyHL+8KH71yz43cECWHswFP5:UUnuZW2N7s71yz4sECWz55
TLSH T1B324DF3303CB3BE3FACB83753D564DAB9DAA40B3459D96F86591D82488C952CDE0C98C
Reporter drb_ra
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
545
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cobaltstrike_shellcode.exe
Verdict:
No threats detected
Analysis date:
2021-11-04 21:53:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c07e47e8-01eb-4778-983a-2b9f3a06f833

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/202495/
Detection(s):
SecuriteInfo.com.Crypt5.BLLV.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug obfuscated packed
Link:
https://www.filescan.io/uploads/6184567d8eec3805367ea297/reports/df73cb13-b1d2-4030-bb3e-43a3bd6418d1/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Cobalt Strike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/53a764f7-f9aa-4a22-9b3f-b8f6be3c9ec5
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/883576
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f10105c7b47462521f6e0e82d79cd17a084e786270fb529919f56c3d46d5152/
Threat name:
Win32.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2021-11-04 21:54:06 UTC
AV detection:
24 of 27 (88.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j4ibaxd3i5dckipw4duc26onc6qijz4ge4h3kkmrt5lmhvdnkfja._file
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:1359593325 backdoor trojan
Link:
https://tria.ge/reports/211104-1r7vzshgb6/
Behaviour
Modifies system certificate store
Cobaltstrike
Malware Config
C2 Extraction:
http://dzf7f2mb4xz8o.cloudfront.net:443/v1/updateCheck
Unpacked files
SH256 hash:
04aa16b413aa0afe046ebcd998ee9305a82ba62870ea4f4b2883a2d6a5f95f3f
MD5 hash:
05e2fabae6973de327c0dc8277c6844b
SHA1 hash:
ed0fe1a0ebcd30c5a4de492ef87416e6d6c83155
Detections:
win_cobalt_strike_auto
Create hunting rule
Link:
https://www.unpac.me/results/71422399-4b0c-4c4e-9ed6-cc0b929e0ddc/
Parent samples :
4f10105c7b47462521f6e0e82d79cd17a084e786270fb529919f56c3d46d5152
cb99d174931956a594a70edd6e8f1889a3dfe0839d78b2c16e09b05590425f19
SH256 hash:
3b551f9781e18283090bac4aeafbbd2db3898b0b51e499f457921ca78f672f22
MD5 hash:
a5dddf6f46f76a160be4af6d8572b6ad
SHA1 hash:
34ef6a068bda56834aea57922f53e1de95159d3e
Detections:
win_cobalt_strike_auto
Create hunting rule
Link:
https://www.unpac.me/results/71422399-4b0c-4c4e-9ed6-cc0b929e0ddc/
SH256 hash:
4f10105c7b47462521f6e0e82d79cd17a084e786270fb529919f56c3d46d5152
MD5 hash:
38be4a6130198e4378e8a931687893f9
SHA1 hash:
932059d0906948149c65376bc72a8faaf51128a8
Link:
https://www.unpac.me/results/71422399-4b0c-4c4e-9ed6-cc0b929e0ddc/
Malware family:
Cobalt Strike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/4f10105c7b47/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4f10105c7b47462521f6e0e82d79cd17a084e786270fb529919f56c3d46d5152

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobaltbaltstrike_strike_Payload_XORed
Create hunting rule
Author:Avast Threat Intel Team
Description:Detects CobaltStrike payloads
Reference:https://github.com/avast/ioc
Rule name:CobaltStrikeBeacon
Create hunting rule
Author:ditekshen, enzo & Elastic
Description:Cobalt Strike Beacon Payload
Rule name:CobaltStrike_ReflectiveLoader_RID3297
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike)
Reference:http://www.clearskysec.com/tulip
Rule name:CobaltStrike_Unmodifed_Beacon
Create hunting rule
Author:yara@s3c.za.net
Description:Detects unmodified CobaltStrike beacon DLL
Rule name:crime_win32_csbeacon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Cobalt Strike loader
Reference:https://twitter.com/VK_Intel/status/1239632822358474753
Rule name:CS_beacon
Create hunting rule
Author:Etienne Maynier tek@randhome.io
Rule name:HKTL_CobaltStrike_Beacon_4_2_Decrypt
Create hunting rule
Author:Elastic
Description:Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_CobaltStrike_Beacon_Strings
Create hunting rule
Author:Elastic
Description:Identifies strings used in Cobalt Strike Beacon DLL
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_Meterpreter_inMemory
Create hunting rule
Author:netbiosX, Florian Roth
Description:Detects Meterpreter in-memory
Reference:https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Rule name:HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5
Create hunting rule
Author:Florian Roth
Description:Detects strings found in CobaltStrike shellcode
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Rule name:HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5_RID361D
Create hunting rule
Author:Florian Roth
Description:Detects strings found in malware samples in APT report in DarkHydrus
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Rule name:HKTL_Win_CobaltStrike
Create hunting rule
Author:threatintel@volexity.com
Description:The CobaltStrike malware family.
Reference:https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
Rule name:INDICATOR_SUSPICIOUS_ReflectiveLoader
Create hunting rule
Author:ditekSHen
Description:detects Reflective DLL injection artifacts
Rule name:ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:WiltedTulip_ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:http://www.clearskysec.com/tulip

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/202495/

Comments