MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 8438bfbb9c978de4f342a3ed19551f735343a9c1ed0c8610a332a83918cb5985. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
CobaltStrike
Vendor detections: 9
| SHA256 hash: | 8438bfbb9c978de4f342a3ed19551f735343a9c1ed0c8610a332a83918cb5985 |
|---|---|
| SHA3-384 hash: | ce9bbfec85f279a15a6630fd194e1ac3d8dd2ddb2275b964aeb778ac243dc65bc7030b824d732354ab03b10fde996e65 |
| SHA1 hash: | 8543ce7c3d2e012344ac1b40bf9055d2bdef9eee |
| MD5 hash: | dcc43f6872da3da500be2562cd0b2789 |
| humanhash: | ten-three-avocado-avocado |
| File name: | dcc43f6872da3da500be2562cd0b2789 |
| Download: | download sample |
| Signature | CobaltStrike |
| File size: | 24'064 bytes |
| First seen: | 2021-08-11 02:29:48 UTC |
| Last seen: | 2021-08-11 03:37:20 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | dd92932e021c9b9f238b2bd809b4c945 (2 x CobaltStrike) |
| ssdeep | 384:3uyMRkY60LuhsGhY/0POJ9uVcRXjG+gZ07bhJDPTZMwf8SVoTgbZs61Fa7nbhE6o:e5Nyh1eMPOJ4WiHZ8HpM28SVoSFeK63 |
| Threatray | 1'103 similar samples on MalwareBazaar |
| TLSH | T1E8B26C8B326549BAE576C27DCF82564BEFB5F49006B4E70D077516AA2F13230E5AE320 |
| Reporter |  StillAzureH |
| Tags: | CobaltStrike exe |
StillAzureH
Matches the same loader that was previously used in the StackUp Aps campaign.BeaconType - HTTPS
Port - 443
SleepTime - 5000
MaxGetSize - 1865121
Jitter - 48
MaxDNS - Not Found
PublicKey_MD5 - 65edfd8cf995109f721bd95f915143ef
C2Server - xagadi.com,/tab_shop_active.css
UserAgent - Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0
HttpPostUri - /zh
Malleable_C2_Instructions - Remove 981 bytes from the beginning
Base64 decode
Base64 decode
HttpGet_Metadata - ConstHeaders
Host: bing.com
Connection: close
Accept: image/jpeg
Metadata
base64url
base64
prepend "wordpress_d6c0405e0d7ab18fd4e6a0b74fce40b0="
header "Cookie"
HttpPost_Metadata - ConstHeaders
Host: bing.com
Connection: close
Accept-Encoding: gzip, br
Content-Type: application/x-www-form-urlencoded
SessionId
base64
prepend "__session__id="
header "Cookie"
Output
mask
base64
prepend "photo="
PipeName - Not Found
DNS_Idle - Not Found
DNS_Sleep - Not Found
SSH_Host - Not Found
SSH_Port - Not Found
SSH_Username - Not Found
SSH_Password_Plaintext - Not Found
SSH_Password_Pubkey - Not Found
SSH_Banner -
HttpGet_Verb - GET
HttpPost_Verb - POST
HttpPostChunk - 0
Spawnto_x86 - %windir%\syswow64\rundll32.exe
Spawnto_x64 - %windir%\sysnative\rundll32.exe
CryptoScheme - 0
Proxy_Config - Not Found
Proxy_User - Not Found
Proxy_Password - Not Found
Proxy_Behavior - Use IE settings
Watermark - 0
bStageCleanup - True
bCFGCaution - False
KillDate - 0
bProcInject_StartRWX - False
bProcInject_UseRWX - False
bProcInject_MinAllocSize - 15717
ProcInject_PrependAppend_x86 - b'\x90\x90\x90\x90'
Empty
ProcInject_PrependAppend_x64 - b'\x90\x90\x90\x90'
Empty
ProcInject_Execute - CreateThread
CreateRemoteThread
RtlCreateUserThread
ProcInject_AllocationMethod - VirtualAllocEx
bUsesCookies - True
HostHeader -
headersToRemove - Not Found
DNS_Beaconing - Not Found
DNS_get_TypeA - Not Found
DNS_get_TypeAAAA - Not Found
DNS_get_TypeTXT - Not Found
DNS_put_metadata - Not Found
DNS_put_output - Not Found
DNS_resolver - Not Found
DNS_strategy - round-robin
DNS_strategy_rotate_seconds - -1
DNS_strategy_fail_x - -1
DNS_strategy_fail_seconds - -1
Intelligence
File Origin
# of uploads :
2
# of downloads :
499
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
382D.dll
Verdict:
No threats detected
Analysis date:
2021-08-10 18:53:32 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
BazarLoader
Verdict:
Malicious
Result
Threat name:
CobaltStrike
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Threat name:
Win64.Trojan.BazarLoader
Status:
Malicious
First seen:
2021-08-11 01:08:03 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
8 of 46 (17.39%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
cobaltstrike
Similar samples:
+ 1'093 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Score:
10/10
Tags:
family:cobaltstrike botnet:0 backdoor trojan
Behaviour
Modifies system certificate store
Blocklisted process makes network request
Cobaltstrike
Malware Config
C2 Extraction:
http://xagadi.com:443/tab_shop_active.css
Unpacked files
SH256 hash:
8438bfbb9c978de4f342a3ed19551f735343a9c1ed0c8610a332a83918cb5985
MD5 hash:
dcc43f6872da3da500be2562cd0b2789
SHA1 hash:
8543ce7c3d2e012344ac1b40bf9055d2bdef9eee
Malware family:
Cobalt Strike
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.