MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 971c693bc67cf7b4b9655282b815bc1ba10ee937f1736ba1ef5fdb7aea392f6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 971c693bc67cf7b4b9655282b815bc1ba10ee937f1736ba1ef5fdb7aea392f6c
SHA3-384 hash: cad7d992180516a500ae152090fc2dd1f4331e08d98c5c38a5073b33b3f8893a618cf452f164ce960f5b3027d08a2802
SHA1 hash: 4c2c4154c2530686f9da216be762359d7d58ccf8
MD5 hash: d8043c83caad8f040877fca78c31ffa8
humanhash: cardinal-apart-echo-maine
File name:971c693bc67cf7b4b9655282b815bc1ba10ee937f1736ba1ef5fdb7aea392f6c.bin
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:32'728 bytes
First seen:2021-07-29 09:44:59 UTC
Last seen:2021-08-03 08:31:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5ba8b48475bd58c9a7045240b5df9ce0 (1 x CobaltStrike)
ssdeep 768:HMwOYA+00+aP3UZeefHPorXyEG6h55Yi6sIIa4J1:swOYA+9RcZeeYrXkM76sIIf1
Threatray 1'023 similar samples on MalwareBazaar
TLSH T1B8E27BCB52245C76E927C97DEBC0CA1BEDB5F44056F1D29E133A82A41F53321B1AE328
Reporter JAMESWT_WT
Tags:CobaltStrike exe signed StackUp ApS

Code Signing Certificate

Organisation:StackUp ApS
Issuer:DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:sha256WithRSAEncryption
Valid from:2021-07-16T00:00:00Z
Valid to:2022-07-19T23:59:59Z
Serial number: 0400c7614f86d75fe4ee3f6192b6feda
Intelligence: 12 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: 64cd94f7ed9b7ba8f7d58445c0b9d9823d37782cc3500d359b86c4a3b091d5b8
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
3
# of downloads :
495
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
971c693bc67cf7b4b9655282b815bc1ba10ee937f1736ba1ef5fdb7aea392f6c.bin
Verdict:
No threats detected
Analysis date:
2021-07-29 09:56:39 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/344f328d-dd2c-4364-947f-9cc19acd4f48

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/174970/
Detection(s):
SecuriteInfo.com.ArtemisD8043C83CAAD.23386.493.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
BazarLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f347bd0b-f1b8-4765-be6e-9ebaff12eb15
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/823715
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
Win64.Backdoor.Meterpreter
Create hunting rule
Status:
Malicious
First seen:
2021-07-28 16:26:09 UTC
File Type:
PE+ (Exe)
AV detection:
3 of 46 (6.52%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
1b11ae98b85bb0645abe36adcd852e6e84b51c6b5c811729f3c19f14f32d4e4f
CobaltStrike
2bfe11c06ffe157399432080f6de6190e1062c99b4a55ec31974b5a37ee8dd3c
CobaltStrike
42104ac31fe7ae7328c209007ea71dc3effb183c736a9bddcf86f690fe96df9a
CobaltStrike
673d8268fd21825ca5f21d8b395cdcede7009b60e540cb36c46f5794626faefb
CobaltStrike
954944ef6cdd1474ed35f27b790a7914156672cc7a1afbcc3214ccc1855ff12e
CobaltStrike
9ca6449c0586a77c55586bcc7adfaef2c3cc53da4713c5ed57fced15a3054545
CobaltStrike
cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58
CobaltStrike
e8d4bf2dc68074adf01dc003d51de3842994ae07fa88c370e8d29f1c27d9c407
CobaltStrike
+ 1'013 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:0 backdoor trojan
Link:
https://tria.ge/reports/210729-5saasq83ce/
Behaviour
Modifies system certificate store
Cobaltstrike
Malware Config
C2 Extraction:
http://refebi.com:443/faq
Unpacked files
SH256 hash:
971c693bc67cf7b4b9655282b815bc1ba10ee937f1736ba1ef5fdb7aea392f6c
MD5 hash:
d8043c83caad8f040877fca78c31ffa8
SHA1 hash:
4c2c4154c2530686f9da216be762359d7d58ccf8
Link:
https://www.unpac.me/results/bc22de53-a011-4b7b-96e6-1e07691ee5a9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/971c693bc67cf7b4b9655282b815bc1ba10ee937f1736ba1ef5fdb7aea392f6c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/174970/

Comments