MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 972ce01537b30f5f6fb618365c91c920c3ac9b58eba0ee5785b05ce203fc90db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CobaltStrike

Vendor detections: 8

Intelligence 8 IOCs YARA 5 File information Comments

SHA256 hash:	972ce01537b30f5f6fb618365c91c920c3ac9b58eba0ee5785b05ce203fc90db
SHA3-384 hash:	cdfdc52a5f2c6a5a747486a6edc2f49c34cb4eda9a8952a01e4df5b390f210a0588b16712141d17e1a60cae037739213
SHA1 hash:	767bf58f396d870c74d848e7f6ec9268528ce78b
MD5 hash:	7c357e54f775f0042c2d8e36d0c38fa9
humanhash:	nevada-stairway-hot-enemy
File name:	SecuriteInfo.com.BackDoor.Meterpreter.119.9979.15208
Download:	download sample
Signature	CobaltStrike Create hunting rule
File size:	135'680 bytes
First seen:	2020-09-22 04:42:25 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0dd88f4b44c1ff4d46bf42a9bdd1976f (2 x CobaltStrike)
ssdeep	1536:k+E3lVgQCzsu0yn/ZIVA6yAx00yZw3SRNr6EInoy7z+lcaCjsWjcdayVLaMNruh:kznLYe2u0FwiRNGx+LB9V3M
TLSH	AED36C0171D48075C07296B16B787AD5F678FCB587AE8A4F3BC8094F8E798C066277A3
Reporter	SecuriteInfoCom
Tags:	CobaltStrike

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

CobaltStrikeBeacon

Link:

https://www.capesandbox.com/analysis/64281/

Detection(s):

SecuriteInfo.com.BackDoor.Meterpreter.119.9979.15208.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

DNS request

Sending an HTTP GET request

Result

Threat name:

CobaltStrike

Detection:

malicious

Classification:

troj.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/471988

Signature

Antivirus / Scanner detection for submitted sample

Contains functionality to detect sleep reduction / modifications

Contains functionality to inject threads in other processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/972ce01537b30f5f6fb618365c91c920c3ac9b58eba0ee5785b05ce203fc90db/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2020-08-04 21:06:51 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Verdict:

malicious

Label(s):

cobaltstrike

emotet

Result

Malware family:

metasploit

Score:

10/10

Tags:

trojan backdoor family:metasploit

Link:

https://tria.ge/reports/200922-k1tfa9km4x/

Behaviour

Modifies system certificate store

MetaSploit

Malware Config

C2 Extraction:

http://172.98.192.214:443/cSVlo1FeFAInvJDJkZ9P99GLwSTqIGUF

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Emotet

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/972ce01537b30f5f6fb618365c91c920c3ac9b58eba0ee5785b05ce203fc90db

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CobaltStrike_Sleep_Decoder_Indicator Create hunting rule
Author:	yara@s3c.za.net
Description:	Detects CobaltStrike sleep_mask decoder

Rule name:	CobaltStrike_Unmodifed_Beacon Create hunting rule
Author:	yara@s3c.za.net
Description:	Detects unmodified CobaltStrike beacon DLL

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	ReflectiveLoader Create hunting rule
Description:	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:	Internal Research

Rule name:	WiltedTulip_ReflectiveLoader Create hunting rule
Author:	Florian Roth
Description:	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:	http://www.clearskysec.com/tulip