MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80d8137f108cde8a47205bff89893dfccf81eae15b13f077374c022076b60f1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 80d8137f108cde8a47205bff89893dfccf81eae15b13f077374c022076b60f1b
SHA3-384 hash: e01ad562277e6a2c5570b1b99062a71c3f0f54508078790358f84d9f40c863ccd44a1923681a553e70991c8abd13ea06
SHA1 hash: 6a726707ba10557083ff9d4c2756d22062edbd07
MD5 hash: b11e19cd8aa546d7ba65d4f13741b3ef
humanhash: yankee-alanine-mike-mississippi
File name:z1.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:46'592 bytes
First seen:2022-06-19 08:30:13 UTC
Last seen:2022-06-19 09:46:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f210072d34cd79cac189f8c3cb21e2a3 (1 x CobaltStrike)
ssdeep 768:1M0QQ6Sb50Hqy1T0GblTM+/pDVzJBVX1MdS4o8BWPKbKqBYgQVnHKu:y0QzSdJoTNbVM0DVHkS4oqifgsq
Threatray 1'781 similar samples on MalwareBazaar
TLSH T16B238D4D771181E9DC5A827C8663C1ABF2B33C360B22AADF4796675B1F737E0A832511
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter obfusor
Tags:CobaltStrike exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
652
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/281219/
Detection(s):
SecuriteInfo.com.ArtemisB11E19CD8AA5.17220.19957.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive shelma
Link:
https://www.filescan.io/uploads/62aedf0339ffd552ad0a5381/reports/db07f8ac-40a7-4a00-b4b1-5f28e23ddbe0/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/39291b8e-b735-41c2-8c13-2f13f874ce92
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1015815
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/80d8137f108cde8a47205bff89893dfccf81eae15b13f077374c022076b60f1b/
Threat name:
Win64.Trojan.Shelma
Create hunting rule
Status:
Malicious
First seen:
2022-06-14 08:10:09 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
5 of 26 (19.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qdmbg7yqrtpiurzalp7ytcj57thyd2xblmj7a5zxjqbca5vwb4nq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
09d8fb54a22c3bb753fce7dc5192221122cf5dc26b42504ffca254e2521dbf8e
CobaltStrike
15ad6630505f5276285e80205b40ebd4a3e975d97b93c390f39c67aad799b6de
CobaltStrike
2825b1fcb91614a08b7c2338e54ee1506915c159bd6a363de7b77c23dd6ea7e0
CobaltStrike
3da3b7a6ce9f51f3298afc7aa931d3178f57b2d1ce857dbd88675c7386866b7e
CobaltStrike
3e1d36766dfab3b000777a6c8a7742e3f454eb9270e835181cfb3ee04e8a1e62
CobaltStrike
d08430ad21c7a08c68416ad117358c281e8d66c1eed9c8a5a044af66488369c0
CobaltStrike
+ 1'771 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:1580103824 backdoor suricata trojan
Link:
https://tria.ge/reports/220619-kepwmsgcd4/
Behaviour
Modifies system certificate store
Cobaltstrike
suricata: ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response
Malware Config
C2 Extraction:
http://service-59v6fwm9-1307868367.sh.apigw.tencentcs.com:443/jquery-3.3.1.min.js
Unpacked files
SH256 hash:
80d8137f108cde8a47205bff89893dfccf81eae15b13f077374c022076b60f1b
MD5 hash:
b11e19cd8aa546d7ba65d4f13741b3ef
SHA1 hash:
6a726707ba10557083ff9d4c2756d22062edbd07
Link:
https://www.unpac.me/results/0ff7c6f4-5ba5-463f-bd03-14b362edd856/
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/80d8137f108c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/80d8137f108cde8a47205bff89893dfccf81eae15b13f077374c022076b60f1b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/281219/

Comments