MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9062e1a48d6531e8022521aebcecbe7913281c1dc282f3230c280f72cf5fca49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9062e1a48d6531e8022521aebcecbe7913281c1dc282f3230c280f72cf5fca49
SHA3-384 hash: 54d3d9c89959f0046825de1a02279eb4b93d1f420c1e0420259cd9144880815f959e5e047e41c38283c1e40380db32a7
SHA1 hash: 5d1400930bbb556316db6b811127f88b86af05fe
MD5 hash: 51e3687182ebda63d30d9573522a2697
humanhash: massachusetts-enemy-oxygen-florida
File name:9062e1a48d6531e8022521aebcecbe7913281c1dc282f3230c280f72cf5fca49
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:294'360 bytes
First seen:2021-08-03 08:31:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 544f414c4fcd3817fd9f4461234ebebe (1 x CobaltStrike)
ssdeep 6144:kFxARWbzOmardDVnny4c3JJJ7UfCsb43rHhD3XfFQKNvOR0DAytsst:cxhbzDar1k4yJJJYfCsb4bHhbzN2iDXt
Threatray 1'060 similar samples on MalwareBazaar
TLSH T129547AF6E76B7019C503E8BC05044F749AA71001316F6AF22E7B406C6DE7CB979F4A66
Reporter JAMESWT_WT
Tags:CobaltStrike exe signed StackUp ApS

Code Signing Certificate

Organisation:StackUp ApS
Issuer:DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:sha256WithRSAEncryption
Valid from:2021-07-16T00:00:00Z
Valid to:2022-07-19T23:59:59Z
Serial number: 0400c7614f86d75fe4ee3f6192b6feda
Intelligence: 12 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: 64cd94f7ed9b7ba8f7d58445c0b9d9823d37782cc3500d359b86c4a3b091d5b8
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
497
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9062e1a48d6531e8022521aebcecbe7913281c1dc282f3230c280f72cf5fca49
Verdict:
No threats detected
Analysis date:
2021-08-03 08:36:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3a6eef93-2a20-41c0-9a33-e6586f965534

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/175974/
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a UDP request
Connection attempt
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/905a5d66-401b-497d-a9ba-2d0dadf7cb9e
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/825974
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9062e1a48d6531e8022521aebcecbe7913281c1dc282f3230c280f72cf5fca49/
Threat name:
Win64.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2021-08-02 11:46:31 UTC
File Type:
PE+ (Exe)
AV detection:
10 of 28 (35.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sbrodjenmuy6qarfegxlz3f6pejsqha5ykbpgiymfahxft27zjeq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
0ecf5a2c06c78f79bc20180e1be1c9e41487b5789b1af712ebb7ed6091486536
CobaltStrike
1b11ae98b85bb0645abe36adcd852e6e84b51c6b5c811729f3c19f14f32d4e4f
CobaltStrike
2bfe11c06ffe157399432080f6de6190e1062c99b4a55ec31974b5a37ee8dd3c
CobaltStrike
6880a560c6cc3dd49bdc94a90dcc8dc69e55a6d842e76bb0dff0038bad6a762f
CobaltStrike
954944ef6cdd1474ed35f27b790a7914156672cc7a1afbcc3214ccc1855ff12e
CobaltStrike
971c693bc67cf7b4b9655282b815bc1ba10ee937f1736ba1ef5fdb7aea392f6c
CobaltStrike
9ca6449c0586a77c55586bcc7adfaef2c3cc53da4713c5ed57fced15a3054545
CobaltStrike
bb4efe96748fcc28b827fc297d060c3ab32053cfb8ea506f8c97000debd22121
CobaltStrike
d1d0c9d1ee7b800d491c9fb3fc94b93e5c59d903a4debb092846c46481077ae0
CobaltStrike
+ 1'050 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:0 backdoor suricata trojan
Link:
https://tria.ge/reports/210803-7aq4cr589n/
Behaviour
Modifies system certificate store
Cobaltstrike
suricata: ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response
Malware Config
C2 Extraction:
http://smallgop.com:443/jquery-3.3.1.min.js
Unpacked files
SH256 hash:
9062e1a48d6531e8022521aebcecbe7913281c1dc282f3230c280f72cf5fca49
MD5 hash:
51e3687182ebda63d30d9573522a2697
SHA1 hash:
5d1400930bbb556316db6b811127f88b86af05fe
Link:
https://www.unpac.me/results/925d117e-2c61-4b22-9a8b-78393a7d4625/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9062e1a48d6531e8022521aebcecbe7913281c1dc282f3230c280f72cf5fca49

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/175974/

Comments