MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 922bc53f37d8f146b6bc6f14195c3dee3b668cb57e17f666db1bfd5ef5d722cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 14


Intelligence 14 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 922bc53f37d8f146b6bc6f14195c3dee3b668cb57e17f666db1bfd5ef5d722cf
SHA3-384 hash: 588249c4bed53b023cbbc65642c5399269b6aa2cd4b9fcf4b30b90bc1fb5fee6a28c13a9d2cbd3e4c73372bbc6eed566
SHA1 hash: 79dc90d157ccd6497b49c424b5ebb2c8450696ac
MD5 hash: d8b56d703242d0d7eb791a52bbc61aeb
humanhash: bulldog-uniform-nitrogen-paris
File name:cs.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:228'864 bytes
First seen:2022-03-28 17:09:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 829da329ce140d873b4a8bde2cbfaa7e (259 x CobaltStrike)
ssdeep 6144:P443XR4SH8C4BeBxi66thkbAzLks1YarGR8ej4rC5B/P:LcZMBIz+YLks1YarGR8Pu/
Threatray 180 similar samples on MalwareBazaar
TLSH T12224BEB1B41DBDA4F08B46B60D4EF0B6AD50EED7A89EA61B70F4A40597CA573300F643
Reporter drb_ra
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cobaltstrike_shellcode.exe
Verdict:
No threats detected
Analysis date:
2022-03-28 17:09:42 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2f902dac-74ee-466f-8396-c76365849a10

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/258690/
Detection(s):
Win.Exploit.D3b71c-9863766-0
Create hunting rule

SecuriteInfo.com.Crypt5.BLLV.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Creating a file in the system32 directory
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/11809/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug obfuscated
Link:
https://www.filescan.io/uploads/6241ebeb1f2042394843c1e4/reports/ddd9aa98-254c-477a-aed9-079d185e0376/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Cobalt Strike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fc0da636-e8e2-4e03-9eda-623d7fab2b29
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/966049
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
cobaltstrike
Create hunting rule
Link:
https://mwdb.cert.pl/sample/922bc53f37d8f146b6bc6f14195c3dee3b668cb57e17f666db1bfd5ef5d722cf/
Threat name:
Win32.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2022-03-28 17:10:06 UTC
File Type:
PE (Exe)
AV detection:
23 of 25 (92.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=siv4kpzx3dyunnv4n4kbsxb55y5wndfvpyl7mzw3dp6v55oxelhq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
0b4ebf0528180d7b88c4ccbd9a5364a46383edcccf0364045ee6d9d0555b63d1
CobaltStrike
3503cc8b2b33ef3f14724bec7e7c8860786f9b62174e1cd87b4ae679ecf8d401
CobaltStrike
aa71d1f8581296304caf7f0a046273e1db94101509319733dc973500dd03fdec
CobaltStrike
b4f6c11f8821d7f8463f29cb85ac120c21f4f55a69b5bc85fbe0bf691de472a8
CobaltStrike
c7f90e07d571707c42557c6169817834d791c438e964878729c941733b3c8ca6
CobaltStrike
+ 170 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220328-vppczacde3/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
922bc53f37d8f146b6bc6f14195c3dee3b668cb57e17f666db1bfd5ef5d722cf
MD5 hash:
d8b56d703242d0d7eb791a52bbc61aeb
SHA1 hash:
79dc90d157ccd6497b49c424b5ebb2c8450696ac
Link:
https://www.unpac.me/results/f8f2627d-a891-439d-8213-ac07108f4c80/
Malware family:
Cobalt Strike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/922bc53f37d8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/922bc53f37d8f146b6bc6f14195c3dee3b668cb57e17f666db1bfd5ef5d722cf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobaltbaltstrike_strike_Payload_XORed
Create hunting rule
Author:Avast Threat Intel Team
Description:Detects CobaltStrike payloads
Reference:https://github.com/avast/ioc
Rule name:CobaltStrikeBeacon
Create hunting rule
Author:ditekshen, enzo & Elastic
Description:Cobalt Strike Beacon Payload
Rule name:CobaltStrike_C2_Encoded_XOR_Config_Indicator
Create hunting rule
Author:yara@s3c.za.net
Description:Detects CobaltStrike C2 encoded profile configuration
Rule name:HKTL_CobaltStrike_Beacon_Strings
Create hunting rule
Author:Elastic
Description:Identifies strings used in Cobalt Strike Beacon DLL
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5
Create hunting rule
Author:Florian Roth
Description:Detects strings found in CobaltStrike shellcode
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Rule name:HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5_RID361D
Create hunting rule
Author:Florian Roth
Description:Detects strings found in malware samples in APT report in DarkHydrus
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Rule name:malware_CobaltStrike_v3v4
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect CobaltStrike Beacon in memory
Reference:https://blogs.jpcert.or.jp/en/2018/08/volatility-plugin-for-detecting-cobalt-strike-beacon.html
Rule name:SUSP_XORed_Mozilla
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:XOREngine_Misc_XOR_Func
Create hunting rule
Author:smiller cc @florian @wesley idea on implementation with yara's built in XOR function
Description:Use with care, https://twitter.com/cyb3rops/status/1237042104406355968

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/258690/

Comments