MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ab8b591feb68911c1383d5072f878735201c0f2a9b0f9838e7bfe2f9b634943. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 6


Intelligence 6 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ab8b591feb68911c1383d5072f878735201c0f2a9b0f9838e7bfe2f9b634943
SHA3-384 hash: 65be509096104be807b8032835ef90ade261a8d3c169055cdcbd96d2993473f771ee25fe0a36ec08a892ac436b656808
SHA1 hash: 65378c671f72ca6aae9f1f7ff8f1d55f06d08518
MD5 hash: 45aa10ee60a6a53aa44138d4793b19f8
humanhash: early-beryllium-alanine-summer
File name:7ab8b591feb68911c1383d5072f878735201c0f2a9b0f9838e7bfe2f9b634943
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:210'944 bytes
First seen:2020-11-10 06:56:58 UTC
Last seen:2024-07-24 16:31:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0bc418575efc832b308d227b31192688 (42 x CobaltStrike)
ssdeep 3072:nrFYcFZKoc5kAfRkYieKMfotGAVXfDSaabHlPcWflklHolUtku8e7L5AuN:WcDYl5Rfot/SjlvlEHohcp
Threatray 116 similar samples on MalwareBazaar
TLSH ED249EA07491E037C04B0039621F8B6E6BF9F9F417B5A447FB885A499E717A3DB29343
Reporter seifreed
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
2
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.CobaltStrike-8091534-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ab8b591feb68911c1383d5072f878735201c0f2a9b0f9838e7bfe2f9b634943/
Threat name:
Win32.PUA.CobaltStrikeBeacon
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 06:59:32 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pk4llep6w2erdqjyhvihf6dyonjadqhsvgypta4opp7c7g3djfbq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
1d7dd6d8454853a489cb20618172f5d0d08615aba118176183f6dbeb0c73f218
CobaltStrike
2e7403807afe677a28efe5dbbf2b48edafa90cac07ff2756def2044cf0d19684
CobaltStrike
46bbcc6fde17df7a4ae20797371415a8e3a51346cd5ceee2487e7add0afc8046
CobaltStrike
7ed85f0b66e478f65122238c3fd734ab83b159e7223af7e37013a07b71066971
CobaltStrike
9a7f52bd83f28938809df099294917af28874eb7c1fa3c34e5fba4f8f1c6a0ec
CobaltStrike
ae63cd0a53cbefb25fa2a48194404ba5facd7b8029a9fe9a6ccd36a11577c9e9
CobaltStrike
bb844851de788e926db25a6fcb2e334aa9deb3ef8b76a0ef71b6fc0c6acafee3
CobaltStrike
d0d5f80d6805234e6dacc2ab884029ba2b1600efbd58a2cce87ac3182b305ca1
CobaltStrike
d9de56210ee0ad4b6c95e450d9c8d41e9141895f41793f7eec5cf6350966583b
CobaltStrike
fa4d61c32a0b0b6c52d9a75bb160c543f3c9730778aea1b005a790ca7c00ffc9
CobaltStrike
+ 106 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike backdoor trojan
Link:
https://tria.ge/reports/201110-1fhf695rm2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Cobaltstrike
Malware Config
C2 Extraction:
http://144.34.184.184:9999/dot.gif
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_CobaltStrike_Beacon_Indicator
Create hunting rule
Author:JPCERT
Description:Detects CobaltStrike beacons
Reference:https://github.com/JPCERTCC/aa-tools/blob/master/cobaltstrikescan.py
Rule name:CobaltStrike
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect CobaltStrike Beacon in memory
Reference:https://blogs.jpcert.or.jp/en/2018/08/volatility-plugin-for-detecting-cobalt-strike-beacon.html
Rule name:CobaltStrikeBeacon
Create hunting rule
Author:enzo
Description:Cobalt Strike Beacon Payload
Rule name:CobaltStrike_C2_Encoded_Config_Indicator
Create hunting rule
Author:yara@s3c.za.net
Description:Detects CobaltStrike C2 encoded profile configuration
Rule name:CobaltStrike_Sleep_Decoder_Indicator
Create hunting rule
Author:yara@s3c.za.net
Description:Detects CobaltStrike sleep_mask decoder
Rule name:CobaltStrike_Unmodifed_Beacon
Create hunting rule
Author:yara@s3c.za.net
Description:Detects unmodified CobaltStrike beacon DLL
Rule name:crime_win32_csbeacon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Cobalt Strike loader
Reference:https://twitter.com/VK_Intel/status/1239632822358474753
Rule name:HKTL_Meterpreter_inMemory
Create hunting rule
Author:netbiosX, Florian Roth
Description:Detects Meterpreter in-memory
Reference:https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Rule name:MALW_cobaltrike
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect CobaltStrike beacon
Rule name:ReflectiveLoader
Create hunting rule
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:SUSP_XORed_Mozilla
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:WiltedTulip_ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:http://www.clearskysec.com/tulip

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments