MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 936861ea91e37611908b21310d461eb7435f2912e9a7576cee22ce22342d659b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 936861ea91e37611908b21310d461eb7435f2912e9a7576cee22ce22342d659b
SHA3-384 hash: ad0238fd1557affd8b97723acf0db1cb29d980dff823ad0fd594a7f35c30d6f6bb6ebb873124df6921c6908ddbd9ce79
SHA1 hash: ae96eb4d2d4cedb527f18194102e5ff628e4f233
MD5 hash: a7c919719bd1a38dbfdb6236ea7a654f
humanhash: ink-utah-gee-sink
File name:a7c919719bd1a38dbfdb6236ea7a654f
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:1'018'880 bytes
First seen:2022-08-17 19:32:07 UTC
Last seen:2022-08-17 22:33:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c65521cbb7b3ba07f8ea6e4363527cdd (2 x CobaltStrike)
ssdeep 24576:652261YReWoDz6QkcdSGabyLl+dHsIP6Tt31PMHHkIcO5H+BtN0wjoUwravae7:71Xr/abyLl+dMIP6Tt31EHHk1O5H+BtP
Threatray 1'270 similar samples on MalwareBazaar
TLSH T14B25F847EAB611F4D8B6D23996232337FCB1B4998734A7C39685690B1F61BF0923D384
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter zbetcheckin
Tags:CobaltStrike exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
689
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a7c919719bd1a38dbfdb6236ea7a654f
Verdict:
No threats detected
Analysis date:
2022-08-17 21:00:16 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f0358343-eb35-4396-af60-d25248e2154a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/299382/
Detection(s):
SecuriteInfo.com.Variant.Tedy.176857.1056.22018.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/62fd42b22093f73528665f61/reports/e6bd8726-0a1b-465c-8e06-b3044d96e772/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Cobalt Strike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b0b3cd10-4b37-4675-b85d-68068b83b9b1
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1053328
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 685845 Sample: FFqxysR1FU Startdate: 17/08/2022 Architecture: WINDOWS Score: 48 17 Multi AV Scanner detection for submitted file 2->17 7 loaddll64.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 regsvr32.exe 7->11         started        13 rundll32.exe 7->13         started        process5 15 rundll32.exe 9->15         started       
Detection:
cobaltstrike
Create hunting rule
Link:
https://mwdb.cert.pl/sample/936861ea91e37611908b21310d461eb7435f2912e9a7576cee22ce22342d659b/
Threat name:
Win64.Backdoor.CobaltStrikeBeacon
Create hunting rule
Status:
Malicious
First seen:
2022-08-17 19:33:08 UTC
File Type:
PE+ (Dll)
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=snugd2ur4n3bdeeleeyq2rq6w5bv6kis5gtvo3hoelhcenbnmwnq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
179bb74f8d75626a8ad8ea331f0a0d81e9d1d7eaf801615bbdc9c4671b97791c
CobaltStrike
5efe564a2c779adebab8e664d524a0cfd026c8ab3a57527bd1d821245ffc2a8c
CobaltStrike
74ace0111970edf84a676c96b0c8180b2f2f6bc0a3f8e7bd1db4c9505e7e1d17
CobaltStrike
971c693bc67cf7b4b9655282b815bc1ba10ee937f1736ba1ef5fdb7aea392f6c
CobaltStrike
99be525b748064edaa30caa911b1122187139c463ad29068c3ee5cf69eed774e
CobaltStrike
a7a0025d77b576bcdaf8b05df362e53a748b64b51dd5ec5d20cf289a38e38d56
CobaltStrike
a9c4eafcff0567c68919c93ddf8baa769392e92706e6b35f7b989310d70f732f
CobaltStrike
b156d3fddec3ec4b06b17703426bdd76896e70784eb3c29d085d385b53ef6f09
CobaltStrike
bb4efe96748fcc28b827fc297d060c3ab32053cfb8ea506f8c97000debd22121
CobaltStrike
+ 1'260 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220817-x9hf9sbhej/
Behaviour
Program crash
Unpacked files
SH256 hash:
936861ea91e37611908b21310d461eb7435f2912e9a7576cee22ce22342d659b
MD5 hash:
a7c919719bd1a38dbfdb6236ea7a654f
SHA1 hash:
ae96eb4d2d4cedb527f18194102e5ff628e4f233
Link:
https://www.unpac.me/results/86475f6b-421f-41c7-a124-918d5f997266/
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/936861ea91e3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/936861ea91e37611908b21310d461eb7435f2912e9a7576cee22ce22342d659b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CobaltStrike

Executable exe 936861ea91e37611908b21310d461eb7435f2912e9a7576cee22ce22342d659b

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2274071/
Cape
Cape
https://www.capesandbox.com/analysis/299382/

Comments


Avatar
zbet commented on 2022-08-17 19:32:17 UTC

url : hxxp://tiyugana.com/ro.dll