MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cd20654fc250ac87991352b57036c4cd65845615d3e76ca708059036725ce84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6cd20654fc250ac87991352b57036c4cd65845615d3e76ca708059036725ce84
SHA3-384 hash: 9066716969e431bed44174f03561bca8b90950af96773bac7c98eca91f3c78fd097b55a13ab1eb26ac08b37dfa855665
SHA1 hash: bfd8e4d34b38e82739507030ae2d203a1506e83c
MD5 hash: 8db0d28d4e9ea59a9e915080a41870d6
humanhash: winter-mango-lake-ohio
File name:6cd20654fc250ac87991352b57036c4cd65845615d3e76ca708059036725ce84
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:1'185'280 bytes
First seen:2020-09-19 11:51:42 UTC
Last seen:2020-09-19 12:36:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 25c4fb4a248389347ae9cf0ce6995420 (6 x Rhadamanthys, 4 x LummaStealer, 1 x CobaltStrike)
ssdeep 24576:ZFk0Ju5C+6zMLNXeWvknzIsrejCwJkWBth/H:ZFHJun6QKnEPjCwS2h
Threatray 84 similar samples on MalwareBazaar
TLSH DF453905ECEA58F9E94A53731CF646AF3332A2090737ADC7CE442976B9535E82732274
Reporter JAMESWT_WT
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
2
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/63711/
Detection(s):
SecuriteInfo.com.Trojan.KillProc2.11621.29759.1552.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
DNS request
Connection attempt
Sending an HTTP GET request
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/470568
Signature
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6cd20654fc250ac87991352b57036c4cd65845615d3e76ca708059036725ce84/
Threat name:
Win32.Trojan.Rozena
Create hunting rule
Status:
Malicious
First seen:
2020-09-14 03:12:49 UTC
File Type:
PE (Exe)
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ntjamvh4eufmq6mrguvvoa3mjtlfqrlblu7hnstqqbmqgzzfz2ca._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
2561379ad92527aabb67d7649589e2a3719db5e57f2b451baf57f57258def793
CobaltStrike
2f72550c99a297558235caa97d025054f70a276283998d9686c282612ebdbea0
CobaltStrike
3dfb4e7ca12b7176a0cf12edce288b26a970339e6529a0b2dad7114bba0e16c3
CobaltStrike
4d71f1eab01045de9ae76ea248be7746bad70c12ad977eeb6e8f8e46bbce6395
CobaltStrike
57a395267a680f4909efd096007d6ec86254502ae1c33a70733f0ccef85c4791
CobaltStrike
5e627b14e776856c2904f622b43da929fbc41c1d0b753cd0f98913d8eeaf3544
CobaltStrike
70eae6d411554b0587f9bc3e7e7cc753e81b8086310dc5fa8181c44632fe1ada
CobaltStrike
96c441a2676616cbc2869de5adf4215bdad4603d970f956cc3de927301599257
CobaltStrike
a68210378135bd42e9a1a8e854fb0cab06f58ffcab9a8583f0654fe9807c5555
CobaltStrike
c786e4de11e64be8d4118cf8ba6b210e3396e3bb579f3afd4bf528c35bab4a6b
CobaltStrike
+ 74 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200919-ll6vlmcq5e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Zbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6cd20654fc250ac87991352b57036c4cd65845615d3e76ca708059036725ce84

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_XORed_Mozilla
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/malwrhunterteam/status/1307004506090205184?s=20
Cape
Cape
https://www.capesandbox.com/analysis/63711/

Comments