🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 515863cb9033eb2d91bf76bb05e86e456d8cd5235e678d9794e28c2e0580ddc3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Cobalt Strike


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 515863cb9033eb2d91bf76bb05e86e456d8cd5235e678d9794e28c2e0580ddc3
SHA3-384 hash: 90145e4c6dafbac9277a020d599d7fbc4400726d2c7609a102e06256271f659c1dee798e3e821d3967bd1418f591993d
SHA1 hash: 0f06dbd95b70cf7219e1dca6222301d3ad58bd7c
MD5 hash: cc731f2d246ca2c701a371c7872d094d
humanhash: shade-charlie-don-freddie
File name:515863cb9033eb2d91bf76bb05e86e456d8cd5235e678d9794e28c2e0580ddc3.ps1
Download: download sample
Signature Cobalt Strike
Create hunting rule
File size:364'250 bytes
First seen:2024-12-23 12:31:29 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 6144:uf4Z+i6kszQabzdy9+WKqrzz/JsjWox4Ac9E0QqBukTSa1+AJlRREbR3Bn8rh1Eg:uAw1HWjXz/JsjWjw0ZBuncLg3t8rxt
Threatray 718 similar samples on MalwareBazaar
TLSH T1177412A78F479F9DC79855C9C2110ECB489BAE8621B0FAD833CD40DBE516EBC267450B
Magika powershell
Reporter JAMESWT_WT
Tags:7d89fcf2-ns1-wsupdate-online Cobalt Strike ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
185
Origin country :
IT IT
Vendor Threat Intelligence
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6769584675bf3268d2fde106
Tags:
ransomware sage remo
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/515863cb9033eb2d91bf76bb05e86e456d8cd5235e678d9794e28c2e0580ddc3
Result
Threat name:
CobaltStrike, Metasploit
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1579880
Signature
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Found malware configuration
Malicious sample detected (through community Yara rule)
Sigma detected: Dot net compiler compiles file from suspicious location
Yara detected CobaltStrike
Yara detected MetasploitPayload
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/515863cb9033eb2d91bf76bb05e86e456d8cd5235e678d9794e28c2e0580ddc3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/515863cb9033eb2d91bf76bb05e86e456d8cd5235e678d9794e28c2e0580ddc3/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kfmghs4qgpvs3en7o25ql2doivwyzvjdlzty3f4u4kgc4bma3xbq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
4bddadadc987456a9cfa5e66d5cab2d84daae9431005ef7277df16e98433e50d
Cobalt Strike
676b73c51ce8fa3921f05cf3cf25c6d45d2ee44b872552cdd991083ca8c3e42f
Cobalt Strike
90f5b6449bce7ad702c76e21663c0d6be42b832468c44ae263e9093108f3118f
Cobalt Strike
95f2e8d7515e86b998bf92e1f0f84593e2b32e87522c2e855f8d8fa4c8a3786a
Cobalt Strike
d01820a86e663083337bae2976557b2f43d5e582b91c7f3a44d41421589bd801
Cobalt Strike
error
Cobalt Strike
+ 708 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/241223-pqlqkszjcw/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/515863cb9033eb2d91bf76bb05e86e456d8cd5235e678d9794e28c2e0580ddc3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_PowerShell_Base64_Decode
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects PowerShell code to decode Base64 data. This can yield many FP

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments