MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c9b7b7c112e154bed63bfa43ff606b7fcc79cb9668f99de032cc09fb6bacc90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Cobalt Strike

Vendor detections: 11

Intelligence 11 IOCs YARA 6 File information Comments

SHA256 hash:	5c9b7b7c112e154bed63bfa43ff606b7fcc79cb9668f99de032cc09fb6bacc90
SHA3-384 hash:	f8787063cc234803eefc6054036a4cbb21673454ba9c2c0715e9a30f3d97a2cdc1c18aa51ed9c631a4c3992293337f75
SHA1 hash:	9085ff29d73038e700fa7b019b499612fe8cedd2
MD5 hash:	1fdf78be6c6f1b895d0f7679336c8d67
humanhash:	october-victor-pizza-cardinal
File name:	injector.ps1
Download:	download sample
Signature	Cobalt Strike Create hunting rule
File size:	485'619 bytes
First seen:	2026-02-26 11:15:10 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	12288:TcPsVk73TBjLx9CBDGJe4OrPqwVwBU1/10EEFzD2:6sV0xN8XCjUd1itC
Threatray	417 similar samples on MalwareBazaar
TLSH	T1F8A4F1738FECDD5CE029EB38250BCDC521680D0487C15E26F35966920FA9DB52AD7B8E
Magika	powershell
Reporter	R4ruk
Tags:	Cobalt Strike ps1

Intelligence

File Origin

# of uploads :

# of downloads :

135

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Rex

Details

Rex

a Base64 and XOR decoded component

Link:

https://research.acce.ciphertechsolutions.com/results/3ff666a3-23a7-4245-853c-9b77786777a7/

Detection(s):

Sanesecurity.Malware.29509.UNOFFICIAL

SecuriteInfo.com.PowerShell.Obfus-4.UNOFFICIAL

Win.Trojan.CobaltStrike-7917400-0

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69a02b588fffa866e3b25c0a

Tags:

cobaltstrike cobalt

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/5c9b7b7c112e154bed63bfa43ff606b7fcc79cb9668f99de032cc09fb6bacc90

Verdict:

Malicious

File Type:

unix shell

Detections:

HEUR:Trojan.Script.Generic HEUR:Trojan.PowerShell.Agent.gen Trojan.PowerShell.Cobalt.a

Link:

https://opentip.kaspersky.com/5c9b7b7c112e154bed63bfa43ff606b7fcc79cb9668f99de032cc09fb6bacc90/results?tab=lookup

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/5c9b7b7c112e154bed63bfa43ff606b7fcc79cb9668f99de032cc09fb6bacc90

Verdict:

Malware

YARA:

1 match(es)

Tags:

Base64 Block Contains Base64 Block DeObfuscated PowerShell

Link:

https://app.malva.re/file/1fdf78be6c6f1b895d0f7679336c8d67

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5c9b7b7c112e154bed63bfa43ff606b7fcc79cb9668f99de032cc09fb6bacc90/

Verdict:

Malicious

Threat:

Trojan.PowerShell.Cobalt

Link:

https://tip.neiki.dev/file/5c9b7b7c112e154bed63bfa43ff606b7fcc79cb9668f99de032cc09fb6bacc90

Threat name:

Script-PowerShell.Trojan.CobaltStrike

Status:

Malicious

First seen:

2026-02-26 11:15:56 UTC

File Type:

Text (PowerShell)

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lsnxw7arfykux3ldx6sd75qgw76mphfzm2hztxqdftaj7nv2zsia._file

Verdict:

malicious

Label(s):

cobaltstrike

Cobalt Strike

317f057e1d593b35eb9a63319e9cb210911f070f8d0ce97ec5944fe5ea602788

Cobalt Strike

4c3618c90ca8fac313a7868778af190a3c22c8c03132505283b213da19ce9b7f

Cobalt Strike

5c9b7b7c112e154bed63bfa43ff606b7fcc79cb9668f99de032cc09fb6bacc90

Cobalt Strike

error

Cobalt Strike

f8219f79a7f0af8eda4338a026b6331717778de14813a3a3ff921b42a636bdd0

Cobalt Strike

fb05a0c8189bbb4dbd25e605bd8b6dda7532b14c5d76b3ce1da727c587c03b67

Cobalt Strike

+ 407 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260226-ncsfjacs5a/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.15

Link:

https://yomi.yoroi.company/submissions/5c9b7b7c112e154bed63bfa43ff606b7fcc79cb9668f99de032cc09fb6bacc90

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CobaltStrike_Resources_Template_x64_Ps1_v3_0_to_v4_x_excluding_3_12_3_13 Create hunting rule
Author:	gssincla@google.com
Description:	Cobalt Strike's resources/template.x64.ps1, resources/template.hint.x64.ps1 and resources/template.hint.x32.ps1 from v3.0 to v4.x except 3.12 and 3.13
Reference:	https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse

Rule name:	CobaltStrike__Resources_Template_x64_Ps1_v3_0_to_v4_x_excluding_3_12_3_13 Create hunting rule
Author:	gssincla@google.com

Rule name:	Msfpayloads_msf_ref Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Metasploit Payloads - file msf-ref.ps1
Reference:	Internal Research

Rule name:	Msfpayloads_msf_ref_RID2ED5 Create hunting rule
Author:	Florian Roth
Description:	Metasploit Payloads - file msf-ref.ps1
Reference:	Internal Research

Rule name:	SUSP_PowerShell_Base64_Decode Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects PowerShell code to decode Base64 data. This can yield many FP

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)