MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 744deacf002489d017c1b09453e52847ec125f79b6ed54cab48aec5a46094bfc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 744deacf002489d017c1b09453e52847ec125f79b6ed54cab48aec5a46094bfc
SHA3-384 hash: f8448c1c06aed59b32ccd74f0afc9aa9c091440750c1fb0b733ecef6186093a914f430b840cb5aba7cd6fedd3aeff1a9
SHA1 hash: 921b3ee8b0c3952f6e7790c38532dc1ae6c0a05d
MD5 hash: b4a8712bcd4f5c7fc72931278aef5043
humanhash: idaho-comet-butter-kentucky
File name:b4a8712bcd4f5c7fc72931278aef5043
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:204'288 bytes
First seen:2020-10-25 08:06:55 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash e66a62b251fcfbbc930b074503d08542 (24 x CobaltStrike)
ssdeep 3072:HNEfMCK7JqusgLiKG5TnN7FgkQB7R80kUzRe5O1:SfM5dS/JBN7jiR80Vv
Threatray 132 similar samples on MalwareBazaar
TLSH DF148CA53184D032D45B0434674BC77E5E7CBDF016A1A987BFC81E599E716A3EB2A303
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/75567/
Detection(s):
Win.Trojan.CobaltStrike-8091534-0
Create hunting rule

Win.Tool.CobaltStrike-6336852-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/509420
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 303833 Sample: Vm9GfbksCV Startdate: 25/10/2020 Architecture: WINDOWS Score: 68 18 Malicious sample detected (through community Yara rule) 2->18 20 Antivirus / Scanner detection for submitted sample 2->20 22 Multi AV Scanner detection for submitted file 2->22 24 Machine Learning detection for sample 2->24 7 loaddll32.exe 1 2->7         started        process3 process4 9 rundll32.exe 7->9         started        11 rundll32.exe 7->11         started        process5 13 WerFault.exe 23 9 9->13         started        dnsIp6 16 192.168.2.1 unknown unknown 13->16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/744deacf002489d017c1b09453e52847ec125f79b6ed54cab48aec5a46094bfc/
Threat name:
Win32.PUA.CobaltStrikeBeacon
Create hunting rule
Status:
Malicious
First seen:
2019-06-11 23:36:00 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
28 of 29 (96.55%)
Threat level:
  1/5
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
02ab2c6e066204eb58cf79e84b41f9361c5c9e1515f35db65c5dc4c3399aa307
CobaltStrike
1044f568614deacf998642d0b334f2a807323a8104c95bb63dd0bf9a3582792a
CobaltStrike
135dc0447b4d637a67d79b5d8e7b1898b8b1f3609eaaba74234413a4e8b7e65c
CobaltStrike
21bfec8403c22b296932e59c83b18fb06b96d5210e6469d84abafc474224d77e
CobaltStrike
2c52595ab1893c638924dae5382e93857c85aa6e5352464747ef8e679ef28d01
CobaltStrike
400752bfd286dfd2d38f1bb83d192200811a02fd8ed91bdb1ab4b28c7cb0ff6d
CobaltStrike
6cb2f8f6895c7bd10388fbb74d271a9adc5285933e78d155b33a3fab13a5863f
CobaltStrike
92b093b1547bc3437f4a56d5fc3e72fca3cff6a61403b43125e47896719786ad
CobaltStrike
d25e5a8313c6cbb5b22b24fdb0b5a67706b1d2a6920515ec2de2cc6f5551f848
CobaltStrike
da533e79efe356df581f530f4830b868e63c4d2c089975e929b91403d01ecc37
CobaltStrike
+ 122 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
trojan backdoor family:cobaltstrike
Link:
https://tria.ge/reports/201025-hqxq4hrcrj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
ServiceHost packer
Cobaltstrike
Malware Config
C2 Extraction:
http://37.252.15.241:80/visit.js
Unpacked files
SH256 hash:
744deacf002489d017c1b09453e52847ec125f79b6ed54cab48aec5a46094bfc
MD5 hash:
b4a8712bcd4f5c7fc72931278aef5043
SHA1 hash:
921b3ee8b0c3952f6e7790c38532dc1ae6c0a05d
Detections:
win_cobalt_strike_auto
Create hunting rule
Link:
https://www.unpac.me/results/26d138a0-6bf8-4457-acfe-ba92a3938df9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Carbanak
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/744deacf002489d017c1b09453e52847ec125f79b6ed54cab48aec5a46094bfc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/75567/

Comments