MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9189f62a3ff193acabd3c38c62ebdc73fede511c4c21e511a4afe18efe1523e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 13


Intelligence 13 IOCs YARA 41 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9189f62a3ff193acabd3c38c62ebdc73fede511c4c21e511a4afe18efe1523e3
SHA3-384 hash: 0321ab4417e6030b74a7516fcd508261ed97dff515e17ab381cac4e53a8af7c594c501a1d8a17e1e33dd24c039a63f58
SHA1 hash: e293cbaeb68ba0b1ab6f32f8ef4a689b54171e09
MD5 hash: 682b94cf7f38c6d20c86174ddcee78c7
humanhash: double-bakerloo-white-freddie
File name:mimeTools.dll
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:100'864 bytes
First seen:2023-12-12 16:45:27 UTC
Last seen:2023-12-12 18:32:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9eee3eb9a28f7fe264e99fb25e691a6b (1 x CobaltStrike)
ssdeep 3072:Jl7I3dDMPWy9ZcTACrd9vHPmiMlMJW8dt7u:JYd/OZcTRHmNr8Pu
Threatray 1 similar samples on MalwareBazaar
TLSH T120A33A9777E504BBE06A8638C8634E15C372F8210665CFAF03A4529A1F277A19D3EF71
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter abuse_ch
Tags:CobaltStrike dll exe


Avatar
abuse_ch
CobaltStrike C2:
34.28.72.212:40003

Intelligence

File Origin
# of uploads :
2
# of downloads :
321
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
CobaltStrikeStager
Create hunting rule
Link:
https://www.capesandbox.com/analysis/466749/
Detection(s):
SecuriteInfo.com.Win64.HacktoolX-gen.22644.5.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Sending a custom TCP request
Running batch commands
Creating a process with a hidden window
Searching for the window
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lolbin masquerade rundll32
Link:
https://www.filescan.io/uploads/65788e4d81a3a8ec606ecfed/reports/a1d1f4c8-51f5-42cd-8d88-8088c8972efd/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/9189f62a3ff193acabd3c38c62ebdc73fede511c4c21e511a4afe18efe1523e3
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1360461
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject code into remote processes
Found malware configuration
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Sets debug register (to hijack the execution of another thread)
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Uses ipconfig to lookup or modify the Windows network settings
Uses whoami command line tool to query computer and username
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1360461 Sample: mimeTools.dll.exe Startdate: 12/12/2023 Architecture: WINDOWS Score: 100 84 Snort IDS alert for network traffic 2->84 86 Found malware configuration 2->86 88 Malicious sample detected (through community Yara rule) 2->88 90 2 other signatures 2->90 10 loaddll64.exe 1 2->10         started        process3 signatures4 102 Contains functionality to inject code into remote processes 10->102 104 Sets debug register (to hijack the execution of another thread) 10->104 106 Modifies the context of a thread in another process (thread injection) 10->106 13 cmd.exe 1 10->13         started        16 rundll32.exe 10->16         started        18 rundll32.exe 10->18         started        20 3 other processes 10->20 process5 signatures6 108 Uses ipconfig to lookup or modify the Windows network settings 13->108 110 Uses whoami command line tool to query computer and username 13->110 22 rundll32.exe 13->22         started        112 Modifies the context of a thread in another process (thread injection) 16->112 114 Contains functionality to detect sleep reduction / modifications 16->114 25 rundll32.exe 16->25         started        27 rundll32.exe 18->27         started        29 rundll32.exe 20->29         started        31 cmd.exe 20->31         started        33 cmd.exe 20->33         started        process7 signatures8 92 Modifies the context of a thread in another process (thread injection) 22->92 35 rundll32.exe 12 22->35         started        38 cmd.exe 25->38         started        41 cmd.exe 25->41         started        94 System process connects to network (likely due to code injection or exploit) 27->94 43 cmd.exe 27->43         started        45 cmd.exe 27->45         started        96 Uses whoami command line tool to query computer and username 29->96 47 cmd.exe 29->47         started        49 cmd.exe 29->49         started        51 2 other processes 31->51 53 2 other processes 33->53 process9 dnsIp10 82 34.28.72.212, 40003, 49704, 49706 ATGS-MMD-ASUS United States 35->82 55 cmd.exe 1 35->55         started        58 cmd.exe 1 35->58         started        98 Uses whoami command line tool to query computer and username 38->98 64 2 other processes 38->64 60 conhost.exe 41->60         started        62 ipconfig.exe 1 41->62         started        66 2 other processes 43->66 68 2 other processes 45->68 70 2 other processes 47->70 72 2 other processes 49->72 signatures11 process12 signatures13 100 Uses whoami command line tool to query computer and username 55->100 74 conhost.exe 55->74         started        76 whoami.exe 1 55->76         started        78 conhost.exe 58->78         started        80 ipconfig.exe 1 58->80         started        process14
Score:
89%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9189f62a3ff193acabd3c38c62ebdc73fede511c4c21e511a4afe18efe1523e3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9189f62a3ff193acabd3c38c62ebdc73fede511c4c21e511a4afe18efe1523e3/
Threat name:
Win64.Backdoor.CobaltStrikeBeacon
Create hunting rule
Status:
Malicious
First seen:
2023-12-12 04:01:18 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
14 of 23 (60.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sge7mkr76gj2zk6tyoggf264op7n4ui4jqq6kenev7qy57qveprq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
9189f62a3ff193acabd3c38c62ebdc73fede511c4c21e511a4afe18efe1523e3
CobaltStrike
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike backdoor trojan
Link:
https://tria.ge/reports/231212-t9y78sabg4/
Behaviour
Gathers network information
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Blocklisted process makes network request
Cobaltstrike
Malware Config
C2 Extraction:
http://34.28.72.212:40003/7Oer
Unpacked files
SH256 hash:
9189f62a3ff193acabd3c38c62ebdc73fede511c4c21e511a4afe18efe1523e3
MD5 hash:
682b94cf7f38c6d20c86174ddcee78c7
SHA1 hash:
e293cbaeb68ba0b1ab6f32f8ef4a689b54171e09
Link:
https://www.unpac.me/results/6b14120f-0a90-42db-b1eb-00b2b454516b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9189f62a3ff1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9189f62a3ff193acabd3c38c62ebdc73fede511c4c21e511a4afe18efe1523e3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Beacon_K5om
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Meterpreter Beacon - file K5om.dll
Reference:https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html
Rule name:Beacon_K5om_RID2B14
Create hunting rule
Author:Florian Roth
Description:Detects Meterpreter Beacon - file K5om.dll
Reference:https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html
Rule name:Cobaltbaltstrike_Beacon_x64
Create hunting rule
Author:Avast Threat Intel Team
Description:Detects CobaltStrike payloads
Reference:https://github.com/avast/ioc
Rule name:Cobaltstrike1
Create hunting rule
Author:Ahmet Payaslioglu | Binalyze DFIR LAB
Description:Cobalt Strike Detection
Rule name:Cobaltstrike2
Create hunting rule
Author:Ahmet Payaslioglu | Binalyze DFIR LAB
Description:Cobalt Strike Detection
Rule name:CobaltStrikeBeacon
Create hunting rule
Author:ditekshen, enzo & Elastic
Description:Cobalt Strike Beacon Payload
Rule name:CobaltStrike_C2_Encoded_XOR_Config_Indicator
Create hunting rule
Author:yara@s3c.za.net
Description:Detects CobaltStrike C2 encoded profile configuration
Rule name:CobaltStrike_MZ_Launcher
Create hunting rule
Author:yara@s3c.za.net
Description:Detects CobaltStrike MZ header ReflectiveLoader launcher
Rule name:CobaltStrike_ReflectiveLoader_RID3297
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike)
Reference:http://www.clearskysec.com/tulip
Rule name:CobaltStrike_Sleeve_BeaconLoader_x64_o_v4_3_v4_4_v4_5_and_v4_6
Create hunting rule
Author:gssincla@google.com
Description:Cobalt Strike's sleeve/BeaconLoader.x64.o (Base) Versions 4.3 through at least 4.6
Reference:https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse
Rule name:CobaltStrike_Unmodifed_Beacon
Create hunting rule
Author:yara@s3c.za.net
Description:Detects unmodified CobaltStrike beacon DLL
Rule name:CobaltStrike__Sleeve_BeaconLoader_x64_o_v4_3_v4_4_v4_5_and_v4_6
Create hunting rule
Author:gssincla@google.com
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:crime_win32_csbeacon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Cobalt Strike loader
Reference:https://twitter.com/VK_Intel/status/1239632822358474753
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:HKTL_CobaltStrike_Beacon_Strings
Create hunting rule
Author:Elastic
Description:Identifies strings used in Cobalt Strike Beacon DLL
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_CobaltStrike_SleepMask_Jul22
Create hunting rule
Author:CodeX
Description:Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated
Reference:https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs
Rule name:HKTL_Meterpreter_inMemory
Create hunting rule
Author:netbiosX, Florian Roth
Description:Detects Meterpreter in-memory
Reference:https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Rule name:HKTL_Win_CobaltStrike
Create hunting rule
Author:threatintel@volexity.com
Description:The CobaltStrike malware family.
Reference:https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
Rule name:INDICATOR_SUSPICIOUS_ReflectiveLoader
Create hunting rule
Author:ditekSHen
Description:detects Reflective DLL injection artifacts
Rule name:Leviathan_CobaltStrike_Sample_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Cobalt Strike sample from Leviathan report
Reference:https://goo.gl/MZ7dRg
Rule name:Leviathan_CobaltStrike_Sample_1_RID3324
Create hunting rule
Author:Florian Roth
Description:Detects Cobalt Strike sample from Leviathan report
Reference:https://goo.gl/MZ7dRg
Rule name:malware_CobaltStrike_v3v4
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect CobaltStrike Beacon in memory
Reference:https://blogs.jpcert.or.jp/en/2018/08/volatility-plugin-for-detecting-cobalt-strike-beacon.html
Rule name:Malware_QA_vqgk
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:VT Research QA uploaded malware - file vqgk.dll
Reference:VT Research QA
Rule name:MALWARE_Win_CobaltStrike
Create hunting rule
Author:ditekSHen
Description:CobaltStrike payload
Rule name:MALW_cobaltrike
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Rule to detect CobaltStrike beacon
Reference:https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:PowerShell_Susp_Parameter_Combo_RID336F
Create hunting rule
Author:Florian Roth
Description:Detects PowerShell invocation with suspicious parameters
Reference:https://goo.gl/uAic1X
Rule name:ReflectiveLoader
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Trojan_Raw_Generic_4
Create hunting rule
Author:FireEye
Reference:https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html
Rule name:troj_win_cobaltstrike_memoryinject
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Detects Cobalt Strike payload typically loaded into memory via PowerShell.
Rule name:WiltedTulip_ReflectiveLoader
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:http://www.clearskysec.com/tulip
Rule name:Windows_Trojan_CobaltStrike_1787eef5
Create hunting rule
Author:Elastic Security
Description:CS shellcode variants
Rule name:Windows_Trojan_CobaltStrike_3dc22d14
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_CobaltStrike_663fc95d
Create hunting rule
Author:Elastic Security
Description:Identifies CobaltStrike via unidentified function code
Rule name:Windows_Trojan_CobaltStrike_ee756db7
Create hunting rule
Description:Attempts to detect Cobalt Strike based on strings found in BEACON
Rule name:Windows_Trojan_CobaltStrike_f0b627fc
Create hunting rule
Description:Rule for beacon reflective loader
Rule name:win_cobalt_strike_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.cobalt_strike.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/466749/

Comments