MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 670d05296e29183d8f292c1fe61003bb8bc608c5ee4916c68996b4f64e587622. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 6


Intelligence 6 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 670d05296e29183d8f292c1fe61003bb8bc608c5ee4916c68996b4f64e587622
SHA3-384 hash: 9c3b969623e3a29fb8df731672f762a7204bd4d81b82dc60ffba56cb43ca138ce52bd007978e039fd9c504b4bb109ea6
SHA1 hash: 8bdcf67e7fb4443804c8fa2c63a6cf799d7f6e28
MD5 hash: da8fc85764f9bf3760d75ca2598cc4dc
humanhash: ceiling-tennessee-winter-carbon
File name:670d05296e29183d8f292c1fe61003bb8bc608c5ee4916c68996b4f64e587622
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:131'072 bytes
First seen:2020-07-13 14:12:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0dd88f4b44c1ff4d46bf42a9bdd1976f (2 x CobaltStrike)
ssdeep 1536:h+qtlFSQMzsu0yJA66Bc6yAp+VuxA/jFOE4noy1z+lcaCjsWjcdckVU3h:hF1zh6Aifu+/jAr+LBxVU
Threatray 87 similar samples on MalwareBazaar
TLSH 58D36C0171D48075C03296B16B787AD5F678FCB58BAE8E4F3BC8094F8A758C066277A3
Reporter JAMESWT_WT
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/25400/
Detection(s):
SecuriteInfo.com.BackDoor.Meterpreter.119.25999.8295.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Creating a file in the Windows subdirectories
Sending a TCP request to an infection source
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/670d05296e29183d8f292c1fe61003bb8bc608c5ee4916c68996b4f64e587622/
Threat name:
Win32.Trojan.Swrort
Create hunting rule
Status:
Malicious
First seen:
2020-07-10 05:45:18 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m4gqkklofemd3dzjfqp6meadxof4mcgf5zernrujs22pmtsyoyra._file
Verdict:
malicious
Similar samples:
0af65c358ae4d3f9db0fc6229e3fd6451c80b6143e0cfb56bdba9d36621ed584
CobaltStrike
2610754a99eb906bc26243eff669ca156c0b0cfb56875fc93ec17a607c95cfb4
CobaltStrike
45b253db751c69bdc1d532167e482ef03f426d4dd06a513d342faf61e976f269
CobaltStrike
5524ff68db56a342888695eaef74d2c73cbd6b612e49a6204a6cf4eef35072f8
CobaltStrike
57a395267a680f4909efd096007d6ec86254502ae1c33a70733f0ccef85c4791
CobaltStrike
8bb24503e3418b4e1879c450818a21da05f7f3a54da7939b3f1733b45c9bb029
CobaltStrike
a2c804408646e8c0481d3ba30a49482721857f540ecabc32c1de77cb91860c64
CobaltStrike
e571cd3a4c0744cb3c5443b868577adced331a7545fcb6e2ed0efbe7506a2f9b
CobaltStrike
f241b9ad9deb20f65e777ea5349b27ca5c70e74c1ca7d82413bcf0b03b8054c8
CobaltStrike
fb01851fc2be012833865bd37f81fa98f6a27131bb660e5b01c5eedb8070ceab
CobaltStrike
+ 77 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
evasion spyware trojan
Link:
https://tria.ge/reports/200713-cyqjbsqsvj/
Behaviour
Modifies system certificate store
Modifies system certificate store
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CobaltStrike_Sleep_Decoder_Indicator
Create hunting rule
Author:yara@s3c.za.net
Description:Detects CobaltStrike sleep_mask decoder
Rule name:CobaltStrike_Unmodifed_Beacon
Create hunting rule
Author:yara@s3c.za.net
Description:Detects unmodified CobaltStrike beacon DLL
Rule name:ReflectiveLoader
Create hunting rule
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:WiltedTulip_ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:http://www.clearskysec.com/tulip

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/25400/

Comments