MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92b093b1547bc3437f4a56d5fc3e72fca3cff6a61403b43125e47896719786ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92b093b1547bc3437f4a56d5fc3e72fca3cff6a61403b43125e47896719786ad
SHA3-384 hash: 25a2e719a048bd71484b7592bf0031e489b24b8b9c3a5d62dfd4f8c5831a66f70402a9f8a31f273f6f9895acd85ace4e
SHA1 hash: d9ccee968fd7931db84df520107608008ddd0a9e
MD5 hash: 00f033767bc50c5e417c98d24857d8aa
humanhash: pip-wyoming-pennsylvania-twelve
File name:92b093b1547bc3437f4a56d5fc3e72fca3cff6a61403b43125e47896719786ad
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:204'292 bytes
First seen:2020-10-24 22:16:57 UTC
Last seen:2020-10-24 22:20:39 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash e66a62b251fcfbbc930b074503d08542 (24 x CobaltStrike)
ssdeep 3072:HNEfMCK7JqusgLiKG5TnN7FgkQB7R80kUzRe5d1Z:SfM5dS/JBN7jiR80VWZ
Threatray 104 similar samples on MalwareBazaar
TLSH 00148CA53184D032D45B0434674BC77E9E7CBDF016A1A987BFC81E599E716A3EB2A303
Reporter seifreed
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
2
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/75298/
Detection(s):
Win.Trojan.CobaltStrike-8091534-0
Create hunting rule

Win.Tool.CobaltStrike-6336852-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/508829
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 303531 Sample: q4GukSq6lw Startdate: 25/10/2020 Architecture: WINDOWS Score: 68 15 Malicious sample detected (through community Yara rule) 2->15 17 Antivirus / Scanner detection for submitted sample 2->17 19 Multi AV Scanner detection for submitted file 2->19 21 Machine Learning detection for sample 2->21 7 loaddll32.exe 1 2->7         started        process3 process4 9 rundll32.exe 7->9         started        11 rundll32.exe 7->11         started        process5 13 WerFault.exe 23 9 9->13         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/92b093b1547bc3437f4a56d5fc3e72fca3cff6a61403b43125e47896719786ad/
Threat name:
Win32.PUA.CobaltStrikeBeacon
Create hunting rule
Status:
Malicious
First seen:
2020-03-09 12:05:00 UTC
AV detection:
30 of 31 (96.77%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=skyjhmkuppbug72kk3k7ypts7sr475vgcqb3imjf4r4jm4mxq2wq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
2fb46244b2a594933ac3e9369d9d014253666d0a91c42a2a1556fe2f09ffe2f8
CobaltStrike
3d8e63b6e83da5e0c57246f860e38f77642e8570c0b40e81fc8e72f6255c2233
CobaltStrike
400752bfd286dfd2d38f1bb83d192200811a02fd8ed91bdb1ab4b28c7cb0ff6d
CobaltStrike
411125515b3bf5e30fbece8001f18c0e453d51a48417b3c567ca7f83e4561740
CobaltStrike
4b459c85c8425e368325d8844148e6a058d350374eb721a3da26c4e85ba26973
CobaltStrike
8a148932d87847341a5cc3e93ba144ea1332229a4334a951449b7458169533bc
CobaltStrike
c83163a6e61b2bf3852b426f8ccccac4044d57b2b4514125624632e836f51660
CobaltStrike
cb9edffdd7ae34c58f62caf55729711de9c60fa796ffd03635f5815cc8eedf3b
CobaltStrike
cec36e8ed65ac6f250c05b4a17c09f58bb80c19b73169aaf40fa15c8d3a9a6a1
CobaltStrike
da533e79efe356df581f530f4830b868e63c4d2c089975e929b91403d01ecc37
CobaltStrike
+ 94 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/201024-d7se434vjn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
ServiceHost packer
Malware Config
C2 Extraction:
http://37.252.15.241:80/IE9CompatViewList.xml
Unpacked files
SH256 hash:
92b093b1547bc3437f4a56d5fc3e72fca3cff6a61403b43125e47896719786ad
MD5 hash:
00f033767bc50c5e417c98d24857d8aa
SHA1 hash:
d9ccee968fd7931db84df520107608008ddd0a9e
Detections:
win_cobalt_strike_auto
Create hunting rule
Link:
https://www.unpac.me/results/e83d6722-50c8-46e5-b227-8f02117f8a2f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Carbanak
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/92b093b1547bc3437f4a56d5fc3e72fca3cff6a61403b43125e47896719786ad

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/75298/

Comments