MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59bae9be7a2733552c1cb99e2a8a00367221bc7ce28ef8d1358ef96472e9f97c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59bae9be7a2733552c1cb99e2a8a00367221bc7ce28ef8d1358ef96472e9f97c
SHA3-384 hash: 56259f411868a62b538906e27dd363077128181dd67b82694ee88ee6e14fc60fc33614a40c539e228e004c4b0ffa8689
SHA1 hash: 7af55dcc0093ba06d4bd94dce1e8df8568d74f1f
MD5 hash: 10ca33b82698ab4349a85a635d50645d
humanhash: mobile-maine-summer-east
File name:02.08.202248.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:223'323 bytes
First seen:2024-09-15 17:36:28 UTC
Last seen:Never
File type:unknown
MIME type:application/octet-stream
ssdeep 3072:p8B+MShO/HHNtjorDx0L+ez6C4CcbZMtTjoyZKdjw+Qpd27rfIpHFLjHyNdrPzQj:p8BsorC0KC4wKu1pdmg9Ffed74
TLSH T12E24BE19989013638CB87DE6CA5277A433546FA88F6053CD493630960BEE91F5EC37EE
Magika bmp
Reporter NDA0E
Tags:CobaltStrike Shellcode

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.Meterpreter.152.19959.2100.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cobalt masquerade
Link:
https://www.filescan.io/uploads/66e71b4d4a48170ff00c4d30/reports/943ac1b0-156b-46aa-bec7-cfbfedeeb39c/overview
Verdict:
Malicious
Labled as:
Trojan.Shellcode.11
Link:
https://www.hybrid-analysis.com/sample/59bae9be7a2733552c1cb99e2a8a00367221bc7ce28ef8d1358ef96472e9f97c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/59bae9be7a2733552c1cb99e2a8a00367221bc7ce28ef8d1358ef96472e9f97c/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lg5otpt2e4zvkla4xgpcvcqagzzcdpd44khprujvr34wi4xj7f6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/59bae9be7a2733552c1cb99e2a8a00367221bc7ce28ef8d1358ef96472e9f97c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CobaltStrike_Resources_Xor_Bin_v2_x_to_v4_x
Create hunting rule
Author:gssincla@google.com
Description:Cobalt Strike's resource/xor.bin signature for version 2.x through 4.x
Reference:https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse
Rule name:CobaltStrike__Resources_Xor_Bin_v2_x_to_v4_x
Create hunting rule
Author:gssincla@google.com
Rule name:malware_CobaltStrike_beacon
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:CobaltStrike encoding code

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CobaltStrike

unknown 59bae9be7a2733552c1cb99e2a8a00367221bc7ce28ef8d1358ef96472e9f97c

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3174919/

Comments