MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6eec1d354aaa981a5bd59e144dce2376dbb5b153de66b3cac6672cd83d0914c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6eec1d354aaa981a5bd59e144dce2376dbb5b153de66b3cac6672cd83d0914c1
SHA3-384 hash: 29864f0e06c4c8f14050f4fbb4178fdc78c5f568315b372b1ae15c49bf3c935adec343c6abd031e781699f797db7dd38
SHA1 hash: 5bd1e7f288a3fcfa89b859137da8d3f716a2732d
MD5 hash: d41b3308a8c2ffe66714ff1478835a1a
humanhash: six-spring-fourteen-purple
File name:cs.dll
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:367'580 bytes
First seen:2023-04-19 08:31:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b06d67c832ff156dd1807981f2919f90 (2 x CobaltStrike)
ssdeep 6144:9ieS8UH6Uedyd1ee2k6Sn4s68dTcEgDAIpiWe97TzGux0siC6pEOEGElVt9BHUWV:se3T9tmFJ+tq
Threatray 346 similar samples on MalwareBazaar
TLSH T106742A467BE55CABFA26423885D7D332333BF59013169F276A24CA320E13DD16EC9687
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10523/12/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:CobaltStrike dll dropped-by-bumblebee exe


Avatar
abuse_ch
Cobalt Strike botnet C2:
reserchmenow.com:80 (170.130.55.144)

Intelligence

File Origin
# of uploads :
1
# of downloads :
316
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
cobaltstrike
Create hunting rule
ID:
1
File name:
cs.dll
Verdict:
Malicious activity
Analysis date:
2023-04-19 08:31:51 UTC
Tags:
cobaltstrike
Link:
https://app.any.run/tasks/6582f54a-e298-45fc-8aa3-c5107346a708

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeStager
Create hunting rule
Link:
https://www.capesandbox.com/analysis/383238/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/80357/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug overlay packed spyeye
Link:
https://www.filescan.io/uploads/643fa70346e0911fda9edbf6/reports/705dd935-d780-4abe-94b0-03b57d7ceb9d/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/6eec1d354aaa981a5bd59e144dce2376dbb5b153de66b3cac6672cd83d0914c1
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/52cde5d9-9ad6-411a-bc52-6405faca64d8
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1216846
Signature
C2 URLs / IPs found in malware configuration
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
System process connects to network (likely due to code injection or exploit)
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 849913 Sample: cs.dll.exe Startdate: 19/04/2023 Architecture: WINDOWS Score: 96 38 Found malware configuration 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 2 other signatures 2->44 8 loaddll64.exe 1 2->8         started        process3 process4 10 rundll32.exe 6 8->10         started        14 rundll32.exe 6 8->14         started        16 cmd.exe 1 8->16         started        18 conhost.exe 8->18         started        dnsIp5 34 pevijup.xyz 10->34 46 System process connects to network (likely due to code injection or exploit) 10->46 48 Found evasive API chain (may stop execution after checking mutex) 10->48 50 Performs DNS queries to domains with low reputation 10->50 52 Queues an APC in another process (thread injection) 10->52 20 WerFault.exe 4 9 10->20         started        36 pevijup.xyz 14->36 22 WerFault.exe 9 14->22         started        24 rundll32.exe 6 16->24         started        signatures6 process7 dnsIp8 29 pevijup.xyz 24->29 32 pevijup.xyz 2.58.15.78, 443, 49697, 49698 HIGHWINDS2US Czech Republic 24->32 27 WerFault.exe 17 9 24->27         started        signatures9 54 Performs DNS queries to domains with low reputation 29->54 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6eec1d354aaa981a5bd59e144dce2376dbb5b153de66b3cac6672cd83d0914c1/
Threat name:
Win64.Backdoor.MeterpreterReverseShell
Create hunting rule
Status:
Malicious
First seen:
2023-04-19 08:32:07 UTC
File Type:
PE+ (Dll)
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n3wb2nkkvkmbuw6vtyke3trdo3n3lmkt3ztlhswgm4wnqpijctaq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
25177f86963cd89171a6f06bcd0559806f7c1fa1cff3a52eee89ad38c024b819
CobaltStrike
35bcc6e1410f3b7ef95301d996f5713e6811fc09b98edeb51d0222cbe099ce14
CobaltStrike
864c5339ddc1ad5df17d454c023d0f34a2bfebe76a19314f552d72123a845863
CobaltStrike
a0410b34f9a1161434b2df05470e2bc5d917ad44e419fe9d6a5008e3e3898b47
CobaltStrike
a27734578daa0ece490f3df8fef37d7218bd91e0d786021c6fa51ebfb40d782d
CobaltStrike
bc74b5b8a64345852af7d6d693558529f4aaaca0d9547aa57279b1cbe998ab70
CobaltStrike
fd2805fcbb98043679e0ce2ccd112134a767df7010acc24c395cffd73dbc56d6
CobaltStrike
+ 336 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike backdoor trojan
Link:
https://tria.ge/reports/230419-ke9wtabb8v/
Behaviour
Program crash
Blocklisted process makes network request
Cobaltstrike
Malware Config
C2 Extraction:
http://pevijup.xyz:443/wp-includes/RELEASES.png
Unpacked files
SH256 hash:
6eec1d354aaa981a5bd59e144dce2376dbb5b153de66b3cac6672cd83d0914c1
MD5 hash:
d41b3308a8c2ffe66714ff1478835a1a
SHA1 hash:
5bd1e7f288a3fcfa89b859137da8d3f716a2732d
Link:
https://www.unpac.me/results/ed8f3034-2a66-4b62-9cef-0ec53db6ac9d/
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6eec1d354aaa/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
CobaltStrike
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6eec1d354aaa981a5bd59e144dce2376dbb5b153de66b3cac6672cd83d0914c1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/383238/

Comments