MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 953c74dee50c9b3c4063a8c8fe06f05f06a9ed83b87e61d4f3ba1d545fb9210a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 953c74dee50c9b3c4063a8c8fe06f05f06a9ed83b87e61d4f3ba1d545fb9210a
SHA3-384 hash: 6382ba0d1312d7f2a7d4054ff07171370c11d909685fe5eb01e221589448c5dfa7e8a912938c0c87e66b82bc594ed723
SHA1 hash: a24e343454ea981b817182a2f241cb7042f82f15
MD5 hash: 0f77a4630b8272f5536ae9efe89201d8
humanhash: fourteen-berlin-potato-sodium
File name:953c74dee50c9b3c4063a8c8fe06f05f06a9ed83b87e61d4f3ba1d545fb9210a
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:113'152 bytes
First seen:2020-10-23 11:26:15 UTC
Last seen:2020-10-23 11:45:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 84fecc110e88eaef3c873ff059d453fa (1 x CobaltStrike)
ssdeep 3072:8dMqlqbOnFo8oJCJ+1vWm1rBv/Wx2i8tIeLn6koBVmIH/IAq:8KqMbOFpoQJ+1hB2x2ilG6LBVmSIh
TLSH F3B39E22F7A688F9C1A68070C7039797F930370C4568BAAF57EC4921BB37631795D3A6
Reporter JAMESWT_WT
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
2
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75018/
Detection(s):
SecuriteInfo.com.Exploit.Shellcode.CC.19240.13803.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sending a UDP request
Creating a file
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/508047
Signature
Contains functionality to infect the boot sector
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 303144 Sample: oEaCVa67lu Startdate: 23/10/2020 Architecture: WINDOWS Score: 52 11 Multi AV Scanner detection for submitted file 2->11 6 oEaCVa67lu.exe 1 2->6         started        process3 signatures4 13 Contains functionality to infect the boot sector 6->13 9 conhost.exe 6->9         started        process5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/953c74dee50c9b3c4063a8c8fe06f05f06a9ed83b87e61d4f3ba1d545fb9210a/
Threat name:
Win64.Trojan.Rozena
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 19:51:32 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=su6hjxxfbsntyqddvdep4bxql4dkt3mdxb7gdvhtxiovix5zeefa._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201023-sv99az3w4j/
Behaviour
Suspicious use of AdjustPrivilegeToken
Unpacked files
SH256 hash:
953c74dee50c9b3c4063a8c8fe06f05f06a9ed83b87e61d4f3ba1d545fb9210a
MD5 hash:
0f77a4630b8272f5536ae9efe89201d8
SHA1 hash:
a24e343454ea981b817182a2f241cb7042f82f15
Link:
https://www.unpac.me/results/17d47585-f503-4055-a490-1a1b77279a5b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Rozena
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/953c74dee50c9b3c4063a8c8fe06f05f06a9ed83b87e61d4f3ba1d545fb9210a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/malwrhunterteam/status/1319595968430473216?s=20
Cape
Cape
https://www.capesandbox.com/analysis/75018/

Comments