MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 644b451ba52efbc864e378ef66d00ce8bed50c2b4c0bd153f29d49ac4f1596c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 13


Intelligence 13 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 644b451ba52efbc864e378ef66d00ce8bed50c2b4c0bd153f29d49ac4f1596c8
SHA3-384 hash: 404950758491ab82dd74f7bb53725b20e4e757e93b923e95499901cb84ca08d335c47d0ff9523119133e63a65405de16
SHA1 hash: f7e20921d4196f38eac7bc629f8579cfc3cc2e91
MD5 hash: 27e07d350d7104327179f72a235686ae
humanhash: sixteen-fanta-michigan-missouri
File name:cs.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:224'256 bytes
First seen:2021-11-04 21:49:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 829da329ce140d873b4a8bde2cbfaa7e (259 x CobaltStrike)
ssdeep 6144:Sqrb+Uoybhi3+zLom3JkFFfhgX0Y6Vii8:lSUoyVW+z9J2Tii
TLSH T1AA24CFB1BCA1DC13F858373AB4ADA3F53D677F2388B48B87963BA245695F01C54486D0
Reporter drb_ra
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
542
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cobaltstrike_shellcode.exe
Verdict:
Malicious activity
Analysis date:
2021-11-04 21:49:11 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/311a4757-9283-4112-9a71-c978d65cb902

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/202493/
Detection(s):
SecuriteInfo.com.Crypt5.BLLV.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
anti-debug obfuscated packed
Link:
https://www.filescan.io/uploads/6184558d8eec3805367ea101/reports/386bacba-8619-4888-a513-d651a69c14a8/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Cobalt Strike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c41aef03-9c7d-409e-8b37-6a2673817f23
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/883574
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/644b451ba52efbc864e378ef66d00ce8bed50c2b4c0bd153f29d49ac4f1596c8/
Threat name:
Win32.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2021-11-04 21:50:06 UTC
AV detection:
24 of 27 (88.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mrfukg5ff354qzhdpdxwnuam5c7nkdbljqf5cu7stve2ytyvs3ea._file
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:1359593325 backdoor trojan
Link:
https://tria.ge/reports/211104-1pxx1aeghm/
Behaviour
Modifies system certificate store
Cobaltstrike
Malware Config
C2 Extraction:
http://cdn.atlassian.com:80/v1/updateCheck
http://survey.gallup.com:80/v1/updateCheck
Unpacked files
SH256 hash:
a3a122d08fe81a53fbfd59921cd7ca519dae9fb45bd1852f5ba44b9ba26d9c8d
MD5 hash:
123d68d58730e915a0eaa5e80ff7425e
SHA1 hash:
fd7e821747d0085696d8493d19a7163de23eb675
Detections:
win_cobalt_strike_auto
Create hunting rule
Link:
https://www.unpac.me/results/d73e1cf0-fdfb-4ae5-af2b-133c082ba3d1/
Parent samples :
644b451ba52efbc864e378ef66d00ce8bed50c2b4c0bd153f29d49ac4f1596c8
48ad23c61c26e6bc527c2dd8479725ce4b5626192b62b1c9ea5b17d1ca51dd56
SH256 hash:
7aa753bad1db21da01400eb163ed3867ac2d8b2a7683a6b76bac3d7920c6bb5d
MD5 hash:
8643fe392cc387f63ea0b974c38d3694
SHA1 hash:
d36c6f4c33681622973e60fd216daaec2cd4336c
Detections:
win_cobalt_strike_auto
Create hunting rule
Link:
https://www.unpac.me/results/d73e1cf0-fdfb-4ae5-af2b-133c082ba3d1/
SH256 hash:
644b451ba52efbc864e378ef66d00ce8bed50c2b4c0bd153f29d49ac4f1596c8
MD5 hash:
27e07d350d7104327179f72a235686ae
SHA1 hash:
f7e20921d4196f38eac7bc629f8579cfc3cc2e91
Link:
https://www.unpac.me/results/d73e1cf0-fdfb-4ae5-af2b-133c082ba3d1/
Malware family:
Cobalt Strike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/644b451ba52e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/644b451ba52efbc864e378ef66d00ce8bed50c2b4c0bd153f29d49ac4f1596c8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobaltbaltstrike_strike_Payload_XORed
Create hunting rule
Author:Avast Threat Intel Team
Description:Detects CobaltStrike payloads
Reference:https://github.com/avast/ioc
Rule name:CobaltStrikeBeacon
Create hunting rule
Author:ditekshen, enzo & Elastic
Description:Cobalt Strike Beacon Payload
Rule name:CobaltStrike_ReflectiveLoader_RID3297
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike)
Reference:http://www.clearskysec.com/tulip
Rule name:CobaltStrike_Unmodifed_Beacon
Create hunting rule
Author:yara@s3c.za.net
Description:Detects unmodified CobaltStrike beacon DLL
Rule name:crime_win32_csbeacon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Cobalt Strike loader
Reference:https://twitter.com/VK_Intel/status/1239632822358474753
Rule name:CS_beacon
Create hunting rule
Author:Etienne Maynier tek@randhome.io
Rule name:HKTL_CobaltStrike_Beacon_4_2_Decrypt
Create hunting rule
Author:Elastic
Description:Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_CobaltStrike_Beacon_Strings
Create hunting rule
Author:Elastic
Description:Identifies strings used in Cobalt Strike Beacon DLL
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_Meterpreter_inMemory
Create hunting rule
Author:netbiosX, Florian Roth
Description:Detects Meterpreter in-memory
Reference:https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Rule name:HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5
Create hunting rule
Author:Florian Roth
Description:Detects strings found in CobaltStrike shellcode
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Rule name:HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5_RID361D
Create hunting rule
Author:Florian Roth
Description:Detects strings found in malware samples in APT report in DarkHydrus
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Rule name:HKTL_Win_CobaltStrike
Create hunting rule
Author:threatintel@volexity.com
Description:The CobaltStrike malware family.
Reference:https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
Rule name:INDICATOR_SUSPICIOUS_ReflectiveLoader
Create hunting rule
Author:ditekSHen
Description:detects Reflective DLL injection artifacts
Rule name:ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:WiltedTulip_ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:http://www.clearskysec.com/tulip

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/202493/

Comments