MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5781fd1c6b3917e6de3875016bb24cd37c75b282281b4feaedef78a524e85fce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CobaltStrike

Vendor detections: 10

Intelligence 10 IOCs YARA 21 File information Comments

SHA256 hash:	5781fd1c6b3917e6de3875016bb24cd37c75b282281b4feaedef78a524e85fce
SHA3-384 hash:	e59ba4089bb0fea4e3c64058fd3d1902f315d18c579acf09aba61a5b8c702f99af87b3cd8af2728555da51f8bcf62fe5
SHA1 hash:	ec928736f14a2e52507ca5e306992e83cf0c4ec5
MD5 hash:	d711217ffdfa60c0101a4e900b7a0e1a
humanhash:	mountain-steak-pip-mango
File name:	d711217ffdfa60c0101a4e900b7a0e1a.exe
Download:	download sample
Signature	CobaltStrike Create hunting rule
File size:	4'592'640 bytes
First seen:	2021-11-14 07:29:38 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c7269d59926fa4252270f407e4dab043 (45 x Hive, 23 x ServHelper, 22 x CobaltStrike)
ssdeep	49152:yedam8aawXkXTrb/TXvO90dL3BmAFd4A64nsfJDsCymhs6jXl7bbxMHKsM3/dHwU:yed/a2/64p3L0suwU3cCVR8n0E
Threatray	233 similar samples on MalwareBazaar
TLSH	T138264B03F89150EDE0AED230C6A6D252BA71B8944B3023D72F51EBB52B76FD46E79311
Reporter	abuse_ch
Tags:	CobaltStrike exe

Intelligence

File Origin

# of uploads :

# of downloads :

580

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/205635/

Detection(s):

Win.Trojan.Shelma-9895456-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Connection attempt

Sending a custom TCP request

Sending a UDP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

monero rozena shelma

Link:

https://www.filescan.io/uploads/6190baff3edf00a722d348b2/reports/88d4f900-e45f-470c-8853-14160d1a6981/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2cbc153b-0e05-4ff8-802a-14ce13e84cbe

Result

Threat name:

CobaltStrike

Detection:

malicious

Classification:

troj

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/888814

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5781fd1c6b3917e6de3875016bb24cd37c75b282281b4feaedef78a524e85fce/

Threat name:

Win64.Trojan.Shelma

Status:

Malicious

First seen:

2021-11-14 07:30:14 UTC

AV detection:

17 of 27 (62.96%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=k6a72hdlhel6nxryouawxmsm2n6hlmucfanu72xn554kkjhil7ha._file

Verdict:

malicious

Label(s):

cobaltstrike

CobaltStrike

11be3a269a06b23158afb18561fb7c059f3105d1d37ddfec980899e296dc267e

CobaltStrike

5cbea0c2d3f18aafe1c3ab60b3d670bcc47e4001f26c8923c3e4735e6964708c

CobaltStrike

6cc8e13f66166e615a847f9444a0258b0e7a01fb8e607c49c482b2b4d50cd829

CobaltStrike

7920fb3873012f1abef8c2abfb905e53317595874985f24b23fb318b54b1e243

CobaltStrike

8344424b2ab65b90171d02df7f9f8625308284c4b25e0e489c005f9c164784c2

CobaltStrike

d3f1d658545c3726233e696e3cea4d66d9a515d60f551ea01abfda00552e17da

CobaltStrike

+ 223 additional samples on MalwareBazaar

Result

Malware family:

cobaltstrike

Score:

10/10

Tags:

family:cobaltstrike botnet:426352781 backdoor trojan

Link:

https://tria.ge/reports/211114-jbt6hsdaer/

Behaviour

Modifies system certificate store

Cobaltstrike

Malware Config

C2 Extraction:

http://103.72.4.163:10088/images/logo2.png
http://103.72.4.163:10088/images/logo.png

Unpacked files

SH256 hash:

5781fd1c6b3917e6de3875016bb24cd37c75b282281b4feaedef78a524e85fce

MD5 hash:

d711217ffdfa60c0101a4e900b7a0e1a

SHA1 hash:

ec928736f14a2e52507ca5e306992e83cf0c4ec5

Link:

https://www.unpac.me/results/fb72a813-640b-4f9b-bf33-a51b23b30424/

Malware family:

Cobalt Strike

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/5781fd1c6b39/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobaltbaltstrike_Beacon_x64 Create hunting rule
Author:	Avast Threat Intel Team
Description:	Detects CobaltStrike payloads
Reference:	https://github.com/avast/ioc

Rule name:	CobaltStrikeBeacon Create hunting rule
Author:	ditekshen, enzo & Elastic
Description:	Cobalt Strike Beacon Payload

Rule name:	CobaltStrike_C2_Encoded_XOR_Config_Indicator Create hunting rule
Author:	yara@s3c.za.net
Description:	Detects CobaltStrike C2 encoded profile configuration

Rule name:	CobaltStrike_MZ_Launcher Create hunting rule
Author:	yara@s3c.za.net
Description:	Detects CobaltStrike MZ header ReflectiveLoader launcher

Rule name:	CobaltStrike_Sleep_Decoder_Indicator Create hunting rule
Author:	yara@s3c.za.net
Description:	Detects CobaltStrike sleep_mask decoder

Rule name:	GoBinTest Create hunting rule

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	HKTL_CobaltStrike_Beacon_4_2_Decrypt Create hunting rule
Author:	Elastic
Description:	Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2
Reference:	https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures

Rule name:	HKTL_CobaltStrike_Beacon_Strings Create hunting rule
Author:	Elastic
Description:	Identifies strings used in Cobalt Strike Beacon DLL
Reference:	https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures

Rule name:	HKTL_Meterpreter_inMemory Create hunting rule
Author:	netbiosX, Florian Roth
Description:	Detects Meterpreter in-memory
Reference:	https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/

Rule name:	HKTL_Win_CobaltStrike Create hunting rule
Author:	threatintel@volexity.com
Description:	The CobaltStrike malware family.
Reference:	https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/

Rule name:	INDICATOR_SUSPICIOUS_ReflectiveLoader Create hunting rule
Author:	ditekSHen
Description:	detects Reflective DLL injection artifacts

Rule name:	MALW_cobaltrike Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Rule to detect CobaltStrike beacon
Reference:	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Rule name:	ReflectiveLoader Create hunting rule
Author:	Florian Roth
Description:	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:	Internal Research

Rule name:	SUSP_XORed_Mozilla Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	Trojan_Raw_Generic_4 Create hunting rule
Author:	FireEye
Reference:	https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html

Rule name:	win_cobalt_strike_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.cobalt_strike.

Rule name:	XOREngine_Misc_XOR_Func Create hunting rule
Author:	smiller cc @florian @wesley idea on implementation with yara's built in XOR function
Description:	Use with care, https://twitter.com/cyb3rops/status/1237042104406355968