MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6880a560c6cc3dd49bdc94a90dcc8dc69e55a6d842e76bb0dff0038bad6a762f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6880a560c6cc3dd49bdc94a90dcc8dc69e55a6d842e76bb0dff0038bad6a762f
SHA3-384 hash: f8277b7a37f282df695f57cc7180f1e1451e500e292c07dfac3dafb4d881d244db14675c4562feb44a2f72c8d085e1a5
SHA1 hash: d07e0b2915d82ef295fc09668904c79f67f1e581
MD5 hash: f2749b4e922131e9654ac738d1318b0f
humanhash: solar-virginia-snake-echo
File name:6880a560c6cc3dd49bdc94a90dcc8dc69e55a6d842e76bb0dff0038bad6a762f
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:33'248 bytes
First seen:2021-07-20 06:04:32 UTC
Last seen:2021-07-20 06:43:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c7acad624d853c4d14e9e7d271551bbc (1 x CobaltStrike)
ssdeep 768:iUqLnSLsHHlKLS7Z8SNooc0/M1Smi6crh55YiAaK:7qLnSGFKe9tk1t+7A9
Threatray 926 similar samples on MalwareBazaar
TLSH T1F5E26CCB52A41C76D92BC93CDFC0CA1BEEB5F45126B0C76E137981A54F53321A1AE329
Reporter JAMESWT_WT
Tags:CobaltStrike exe signed Tellingent Limited

Code Signing Certificate

Organisation:Tellingent Limited
Issuer:DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:sha256WithRSAEncryption
Valid from:2021-07-05T00:00:00Z
Valid to:2022-07-13T23:59:59Z
Serial number: 046ef51984e5b68e84589394684f1584
Intelligence: 4 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: bb57515b0a645bba824cfedb1a8c582993c3f943cf88dc75ff095788e21e210f
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
498
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
filedata
Verdict:
No threats detected
Analysis date:
2021-07-19 13:41:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b549e046-79be-4211-9445-9153059c4d9a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/172694/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37260403.3661.24967.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
BazarLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/88792c68-d158-4c0c-a4da-001658b1e1a8
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/818312
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Sigma detected: CobaltStrike Load by Rundll32
System process connects to network (likely due to code injection or exploit)
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 450723 Sample: filedata.dll Startdate: 19/07/2021 Architecture: WINDOWS Score: 92 26 Found malware configuration 2->26 28 Malicious sample detected (through community Yara rule) 2->28 30 Antivirus detection for URL or domain 2->30 32 3 other signatures 2->32 7 loaddll64.exe 1 2->7         started        process3 process4 9 rundll32.exe 6 7->9         started        13 rundll32.exe 6 7->13         started        15 cmd.exe 1 7->15         started        dnsIp5 24 minicombosoft.com 88.80.148.177, 443, 49735, 49736 BELCLOUDBG Bulgaria 9->24 34 System process connects to network (likely due to code injection or exploit) 9->34 17 rundll32.exe 6 15->17         started        signatures6 process7 dnsIp8 20 minicombosoft.com 17->20 22 192.168.2.1 unknown unknown 17->22
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6880a560c6cc3dd49bdc94a90dcc8dc69e55a6d842e76bb0dff0038bad6a762f/
Threat name:
Win64.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2021-07-19 23:54:02 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
13 of 46 (28.26%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
2bfe11c06ffe157399432080f6de6190e1062c99b4a55ec31974b5a37ee8dd3c
CobaltStrike
2cb4d628278053eba42c82d58fb894c230451ffe70d519ff79c5f1cc76f32fd9
CobaltStrike
6543e374acbfe9a3bcfa9a76cb743aaea934c1a1fce7c419b42c27b3fbb1f880
CobaltStrike
673d8268fd21825ca5f21d8b395cdcede7009b60e540cb36c46f5794626faefb
CobaltStrike
9ca6449c0586a77c55586bcc7adfaef2c3cc53da4713c5ed57fced15a3054545
CobaltStrike
bcbd4211108cf3c477de91d78383150e1d30f98d41c372770503eb259a762824
CobaltStrike
cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58
CobaltStrike
d4a027269ca7a78f578e980333ac22f8ab39d5f4ef71490b49af6cb884195321
CobaltStrike
e8d4bf2dc68074adf01dc003d51de3842994ae07fa88c370e8d29f1c27d9c407
CobaltStrike
+ 916 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:0 backdoor trojan
Link:
https://tria.ge/reports/210720-4kt2e5m7se/
Behaviour
Modifies system certificate store
Blocklisted process makes network request
Cobaltstrike
Malware Config
C2 Extraction:
http://minicombosoft.com:443/jquery-3.3.1.min.js
Unpacked files
SH256 hash:
6880a560c6cc3dd49bdc94a90dcc8dc69e55a6d842e76bb0dff0038bad6a762f
MD5 hash:
f2749b4e922131e9654ac738d1318b0f
SHA1 hash:
d07e0b2915d82ef295fc09668904c79f67f1e581
Link:
https://www.unpac.me/results/3fc6968e-3d74-4f7e-be0d-c4c841ab45ef/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6880a560c6cc3dd49bdc94a90dcc8dc69e55a6d842e76bb0dff0038bad6a762f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/malwrhunterteam/status/1417181186686914561?s=20
Cape
Cape
https://www.capesandbox.com/analysis/172694/

Comments