MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6881531ab756d62bdb0c3279040a5cbe92f9adfeccb201cca85b7d3cff7158d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6881531ab756d62bdb0c3279040a5cbe92f9adfeccb201cca85b7d3cff7158d3
SHA3-384 hash: 1f10efd9c928d64d8930068215f8a55b7e343b2b86f3d89d2669692bfb303d30137223761b5fbeebab44f8c00d12bdea
SHA1 hash: dd41e722a6c2edf306f31905af8cee7c47f76514
MD5 hash: 809747bf6893d8b20249407de8b1c83c
humanhash: romeo-kentucky-minnesota-quiet
File name:payload.ps1
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:4'750 bytes
First seen:2022-01-04 06:23:46 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 96:mTuhzuecAHUXtpf8VTN3U9xKvSAdoDrFkuaT7Co9n58mvGugft72eMfOvPXX:DUe9HUXn03Ex6S6okuavz99o7SOvPXX
Threatray 136 similar samples on MalwareBazaar
TLSH T1BDA13ACE9775B3508DF819E1B2F91A5F02C91DBB3934AF592F367CA0006BC951AB820C
Reporter JAMESWT_WT
Tags:CobaltStrike ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
826
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.PowerShell.Inject.66.28604.9084.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
powershell
Link:
https://www.filescan.io/uploads/61d3e809bfe53d318f254211/reports/72355d67-292e-41f9-aea6-577bacc6d7f7/overview
Result
Verdict:
MALICIOUS
Details
Base64 Encoded Powershell Directives
Detected one or more base64 encoded Powershell directives.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6881531ab756d62bdb0c3279040a5cbe92f9adfeccb201cca85b7d3cff7158d3/
Threat name:
Script-PowerShell.Trojan.Pantera
Create hunting rule
Status:
Malicious
First seen:
2022-01-04 06:23:35 UTC
File Type:
Text (PowerShell)
AV detection:
8 of 43 (18.60%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ncavggvxk3lcxwymgj4qics4x2jptlp6zszadtfiln6tz73rldjq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
4970f05913aa3f02abc082a82fbf8cf2fc36995b898786cde396b93dce74b859
CobaltStrike
662688d36dc7b035a0dc23d09d5d4c25fa70408373266f72c6d03d3187adbfd5
CobaltStrike
7b2bb3a9b505b92b22502466ec2f3ba21f27a5264e85587ccac913c9260bbba9
CobaltStrike
8370b5aaf5d21fdfe7052c90b1e6b8fd3e0fa0bc26007badd416b1d4a99bc3cd
CobaltStrike
8f3eb6ca303de759c0530906ad4675432d7d3361641b46413e12f325b4028081
CobaltStrike
9bf4965b4daccbf2252291b215630adc8eb345038e48b63ef3e92e9af35cf1ee
CobaltStrike
a3b71dfc0235bd33cd7d9d05db130acc2d4d4852522279aab9ceb5ea9f3d0ca9
CobaltStrike
af2bc53c341eaa7f66aeb3e4ebf060b686ea155c53dabde46b5be66cbd43d803
CobaltStrike
b9f2bbcbdefc6df6db07e553ce0e3e492ce918f3d34c631962b4aa08d6c8699c
CobaltStrike
fba8817602cb7dae175d9fec0900fbfd3e097aae4d32befaecd87d6e3fdb7412
CobaltStrike
+ 126 additional samples on MalwareBazaar
Result
Malware family:
metasploit
Create hunting rule
Score:
  10/10
Tags:
family:metasploit backdoor trojan
Link:
https://tria.ge/reports/220104-g53nmsfha9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Blocklisted process makes network request
MetaSploit
Malware Config
C2 Extraction:
http://47.242.164.33:8083/rpc
Malware family:
Cobalt Strike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/6881531ab756/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6881531ab756d62bdb0c3279040a5cbe92f9adfeccb201cca85b7d3cff7158d3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_Encoded_Powershell_Directives
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/malwrhunterteam/status/1478110863173300233?s=20

Comments