MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cc8e13f66166e615a847f9444a0258b0e7a01fb8e607c49c482b2b4d50cd829. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CobaltStrike

Vendor detections: 7

Intelligence 7 IOCs YARA 20 File information Comments

SHA256 hash:	6cc8e13f66166e615a847f9444a0258b0e7a01fb8e607c49c482b2b4d50cd829
SHA3-384 hash:	ff24ad49854bc6a23a987b4928daf0519aa198048194d95d522775a57dbef0ad9d166d8ccec5b9d6ea2b3dbb6abd69f7
SHA1 hash:	1b39f54af5933b12a8339d62d13a7e96c78d0f8c
MD5 hash:	43894eba5c6a9c7048ddad4ca301bafc
humanhash:	angel-magazine-golf-item
File name:	43894eba5c6a9c7048ddad4ca301bafc.exe
Download:	download sample
Signature	CobaltStrike Create hunting rule
File size:	4'592'640 bytes
First seen:	2021-09-20 17:56:46 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c7269d59926fa4252270f407e4dab043 (45 x Hive, 23 x ServHelper, 22 x CobaltStrike)
ssdeep	49152:Ned6m8aawXkXTrb/TXvO90dL3BmAFd4A64nsfJjsCymBs6j8l7bbxsHKsM3/dHwA:NedfaW/ajp3r0vuwU3PCVR8n0E
Threatray	197 similar samples on MalwareBazaar
TLSH	T1F6264B03F89150EDE0AED230C6A6D252BA71B8944B3023D72F51EBB52B76FD46E79311
Reporter	abuse_ch
Tags:	CobaltStrike exe

Intelligence

File Origin

# of uploads :

# of downloads :

563

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

43894eba5c6a9c7048ddad4ca301bafc.exe

Verdict:

No threats detected

Analysis date:

2021-09-20 17:58:51 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/e013e56b-b685-4566-be3f-ea0a0aaba5f7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/189555/

Detection(s):

SecuriteInfo.com.Artemis43894EBA5C6A.24723.27540.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Connection attempt

Sending a custom TCP request

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/577a2b83-1ba0-47ce-ae1f-d3b162966e00

Result

Threat name:

CobaltStrike

Detection:

malicious

Classification:

troj

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/854366

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6cc8e13f66166e615a847f9444a0258b0e7a01fb8e607c49c482b2b4d50cd829/

Threat name:

Win64.Trojan.WinGoRozena

Status:

Malicious

First seen:

2021-09-20 17:57:11 UTC

AV detection:

6 of 28 (21.43%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=nteocp3gczxgcwuep6kejibfrmhhuap3rzqhysoeqkzljvim3auq._file

Verdict:

malicious

Label(s):

cobaltstrike

CobaltStrike

11be3a269a06b23158afb18561fb7c059f3105d1d37ddfec980899e296dc267e

CobaltStrike

8344424b2ab65b90171d02df7f9f8625308284c4b25e0e489c005f9c164784c2

CobaltStrike

87dca59ec3d55bcb1b05da564e5ce0a164ab633f1c46a18a97f72a30efff7388

CobaltStrike

9a7d2b2c96ee9b7b0ddc1665988d935a719f04cdb2b2dd331ec36aa4f6597506

CobaltStrike

d44d718c247b1664861f987b1725314f152e43e7c1da80b163f812e1b7c3fdb7

CobaltStrike

e292bf04e0c03341436ab4411ddde881129db4904ae2234952f3a655f14d5cb7

CobaltStrike

+ 187 additional samples on MalwareBazaar

Result

Malware family:

cobaltstrike

Score:

10/10

Tags:

family:cobaltstrike botnet:426352781 backdoor trojan

Link:

https://tria.ge/reports/210920-wjky2aefh6/

Behaviour

Modifies system certificate store

Cobaltstrike

Malware Config

C2 Extraction:

http://103.72.4.163:10088/images/logo2.png
http://103.72.4.163:10088/images/logo.png

Unpacked files

SH256 hash:

6cc8e13f66166e615a847f9444a0258b0e7a01fb8e607c49c482b2b4d50cd829

MD5 hash:

43894eba5c6a9c7048ddad4ca301bafc

SHA1 hash:

1b39f54af5933b12a8339d62d13a7e96c78d0f8c

Link:

https://www.unpac.me/results/fd3a2819-e5e3-4c10-a0b4-a7cd16637a34/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6cc8e13f66166e615a847f9444a0258b0e7a01fb8e607c49c482b2b4d50cd829

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobaltbaltstrike_Beacon_x64 Create hunting rule
Author:	Avast Threat Intel Team
Description:	Detects CobaltStrike payloads
Reference:	https://github.com/avast/ioc

Rule name:	CobaltStrikeBeacon Create hunting rule
Author:	ditekshen, enzo & Elastic
Description:	Cobalt Strike Beacon Payload

Rule name:	CobaltStrike_C2_Encoded_XOR_Config_Indicator Create hunting rule
Author:	yara@s3c.za.net
Description:	Detects CobaltStrike C2 encoded profile configuration

Rule name:	CobaltStrike_MZ_Launcher Create hunting rule
Author:	yara@s3c.za.net
Description:	Detects CobaltStrike MZ header ReflectiveLoader launcher

Rule name:	CobaltStrike_Sleep_Decoder_Indicator Create hunting rule
Author:	yara@s3c.za.net
Description:	Detects CobaltStrike sleep_mask decoder

Rule name:	GoBinTest Create hunting rule

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	HKTL_CobaltStrike_Beacon_4_2_Decrypt Create hunting rule
Author:	Elastic
Description:	Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2
Reference:	https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures

Rule name:	HKTL_CobaltStrike_Beacon_Strings Create hunting rule
Author:	Elastic
Description:	Identifies strings used in Cobalt Strike Beacon DLL
Reference:	https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures

Rule name:	HKTL_Meterpreter_inMemory Create hunting rule
Author:	netbiosX, Florian Roth
Description:	Detects Meterpreter in-memory
Reference:	https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/

Rule name:	HKTL_Win_CobaltStrike Create hunting rule
Author:	threatintel@volexity.com
Description:	The CobaltStrike malware family.
Reference:	https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/

Rule name:	INDICATOR_SUSPICIOUS_ReflectiveLoader Create hunting rule
Author:	ditekSHen
Description:	detects Reflective DLL injection artifacts

Rule name:	MALW_cobaltrike Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Rule to detect CobaltStrike beacon
Reference:	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Rule name:	ReflectiveLoader Create hunting rule
Author:	Florian Roth
Description:	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:	Internal Research

Rule name:	SUSP_XORed_Mozilla Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	Trojan_Raw_Generic_4 Create hunting rule
Author:	FireEye
Reference:	https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html