🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 788ac194f2257c682a7f8c9a0900a388c3d0b58aba55cf756405d0de3fbf39e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Cobalt Strike


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 788ac194f2257c682a7f8c9a0900a388c3d0b58aba55cf756405d0de3fbf39e7
SHA3-384 hash: 50a41407db6af1b0a51f03a5620330f63272b8c07c3d4cb8fa46392dd9dac086f7b899b484c8bff0f9908f02f38e6dce
SHA1 hash: 38c8a407e2196eb01b53915dedfc043e72544728
MD5 hash: 4ed16fcbcd8717bd3721521e43af72b3
humanhash: indigo-idaho-lima-delaware
File name:NoExplore.exe
Download: download sample
Signature Cobalt Strike
Create hunting rule
File size:22'048 bytes
First seen:2025-03-15 16:47:58 UTC
Last seen:2025-03-15 17:19:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c835c068a62b32b94b572af851b85fc9 (1 x Cobalt Strike)
ssdeep 384:zNTH9zvEwdljC/WJX1zNlKZ0i8MKr4ie9osJU1nfeYDq:zNTHVvVdljC/WZ1ZxM5ie9osJomyq
Threatray 1 similar samples on MalwareBazaar
TLSH T114A2A08927B03847D14A42767499D76ADA1BEC30ADBE03FB09C43B0F683D951DF154B2
TrID 40.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
16.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
12.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.0% (.EXE) Win32 Executable (generic) (4504/4/1)
5.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 3c7c8494c6c2c3c0 (1 x Cobalt Strike)
Reporter 2huMarisa
Tags:Cobalt Strike exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
1'198
Origin country :
CA CA
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
NoExplore.exe
Verdict:
Malicious activity
Analysis date:
2024-02-10 15:59:09 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3f36b092-860a-492a-b3b5-da75c6e04b81

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67d5c13808116ce425715616
Tags:
virus
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug crypt diskwriter packed packed packer_detected petite xpack
Link:
https://www.filescan.io/uploads/67d5af670a7899f357977491/reports/d9eb2d58-1142-4239-83d9-89570a5e7c45/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/788ac194f2257c682a7f8c9a0900a388c3d0b58aba55cf756405d0de3fbf39e7
Malware family:
PEtite
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/d71ecb8a-6035-43b3-a05c-013a242e0e04
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
63 / 100
Link:
https://www.joesandbox.com/analysis/1639486
Signature
Antivirus / Scanner detection for submitted sample
Creates a Image File Execution Options (IFEO) Debugger entry
Creates an undocumented autostart registry key
Disables UAC (registry)
Infects the VBR (Volume Boot Record) of the hard disk
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
PE file has nameless sections
Writes directly to the primary disk partition (DR0)
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/788ac194f2257c682a7f8c9a0900a388c3d0b58aba55cf756405d0de3fbf39e7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/788ac194f2257c682a7f8c9a0900a388c3d0b58aba55cf756405d0de3fbf39e7/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pcfmdfhsev6gqkt7rsnasafdrdb5bnmkxjk465leaxin4p57hhtq._file
Verdict:
suspicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
788ac194f2257c682a7f8c9a0900a388c3d0b58aba55cf756405d0de3fbf39e7
Cobalt Strike
error
Cobalt Strike
Result
Malware family:
n/a
Score:
  10/10
Tags:
bootkit defense_evasion discovery persistence trojan
Link:
https://tria.ge/reports/250315-va6cyaysav/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
System policy modification
System Location Discovery: System Language Discovery
Checks whether UAC is enabled
Writes to the Master Boot Record (MBR)
Event Triggered Execution: Image File Execution Options Injection
UAC bypass
Malware Family:
n/a
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e311618f-de61-4352-878f-772a30f022aa
Unpacked files
SH256 hash:
788ac194f2257c682a7f8c9a0900a388c3d0b58aba55cf756405d0de3fbf39e7
MD5 hash:
4ed16fcbcd8717bd3721521e43af72b3
SHA1 hash:
38c8a407e2196eb01b53915dedfc043e72544728
Link:
https://www.unpac.me/results/d49e5bf6-450a-4dc8-a145-a4bed9e9273d/
SH256 hash:
e37aa72bca3cecb9bdbe51cbd81ec1143bb17163088a1379a4ccb93f5d881e76
MD5 hash:
5cac4fe734fc8454ccb847e030beee38
SHA1 hash:
34298fe220e35f614b2c837cf1dc2604ab0882d6
Link:
https://www.unpac.me/results/d49e5bf6-450a-4dc8-a145-a4bed9e9273d/
SH256 hash:
ad80064f71d273967dcf0b14b9cd6e84d79a132231d619687d9266c7807bdfe0
MD5 hash:
a35ee23aaab26afc575ac83df9572b57
SHA1 hash:
81ea38c694ce9702faddfb961f17c1bbf628a76d
Link:
https://www.unpac.me/results/d49e5bf6-450a-4dc8-a145-a4bed9e9273d/
SH256 hash:
00b9c0120df0595184523a3620ef9b3c3e11fc0e61d366d7eeabb646647cfceb
MD5 hash:
bd1f243ee2140f2f6118a7754ea02a63
SHA1 hash:
cdf7dd7dd1771edcc473037af80afd7e449e30d9
Link:
https://www.unpac.me/results/d49e5bf6-450a-4dc8-a145-a4bed9e9273d/
SH256 hash:
0377585ec50ed2e1b3d8519be272599f31024accd20b484ddae8240e09cc83b4
MD5 hash:
13d3997b43c3d5cbafb0ff10b6f0dee1
SHA1 hash:
e650a76f3fa8d28e2ff3751ccf44d124ef2b82bd
Link:
https://www.unpac.me/results/d49e5bf6-450a-4dc8-a145-a4bed9e9273d/
SH256 hash:
1d0392095ff0040de3dc9cf487a1f3af24b5c61f2adbf3b0d33cae1baa29aef6
MD5 hash:
377cd85d1262362833e7783b251138e5
SHA1 hash:
1ae14f589c3fdabee4460dbddae2944e04616cfe
Link:
https://www.unpac.me/results/d49e5bf6-450a-4dc8-a145-a4bed9e9273d/
SH256 hash:
623c73797a5168b37644dc247ce07db89f43b42c2a80b8053377ff8c636d71fe
MD5 hash:
3823f59dc5b84ae1df473c0f05cc2092
SHA1 hash:
20e040cb7121e5002d2929302020c65d352b5335
Link:
https://www.unpac.me/results/d49e5bf6-450a-4dc8-a145-a4bed9e9273d/
SH256 hash:
8d1fc95b4928142bd610df851b377d50a66b6f6c690b70efaf60f0df78bd2719
MD5 hash:
7c6a11da7d9d93ad883044b01cd11b41
SHA1 hash:
170243cc69493a4587a0860e8a8006c4c5679841
Link:
https://www.unpac.me/results/d49e5bf6-450a-4dc8-a145-a4bed9e9273d/
SH256 hash:
00d0258d4cd3da4a06b32e2b3ed048c347593e4d103c933aa9714189da5c5cac
MD5 hash:
51385c762c73b90ed38dd1f9d2f24486
SHA1 hash:
24d748a983cc9506e49dc818f811f56687f21c87
Link:
https://www.unpac.me/results/d49e5bf6-450a-4dc8-a145-a4bed9e9273d/
SH256 hash:
4360214cb93983f5e7d42c0f65c470450e949e73be76b2811b80177b1ce84ac9
MD5 hash:
28cdfca770fe9dfe8927dd77a3699430
SHA1 hash:
42f9792fffc38a8e8a58e5b05f91e3fbe964fdbd
Link:
https://www.unpac.me/results/d49e5bf6-450a-4dc8-a145-a4bed9e9273d/
SH256 hash:
c7470c116f0aa4d7e74847bdd68bf7f45ddcb7abb957bfd67932eef2e5812ee0
MD5 hash:
7465b65184ac022fb5dc942bc0069759
SHA1 hash:
da14149af24f3b1ed1f755e896a8e40e88cbea08
Link:
https://www.unpac.me/results/d49e5bf6-450a-4dc8-a145-a4bed9e9273d/
SH256 hash:
2fdd97ce9faa15c27d5d1f14d28c8ce09a05f0e5aa6c981512c2897390c40fa5
MD5 hash:
4e017d93d2cca4ad18efe33956b53380
SHA1 hash:
c956dbdd06c90e9e48b48bb39578ac599fbce705
Link:
https://www.unpac.me/results/d49e5bf6-450a-4dc8-a145-a4bed9e9273d/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/788ac194f225/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/788ac194f2257c682a7f8c9a0900a388c3d0b58aba55cf756405d0de3fbf39e7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryA

Comments