MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9759daca251ccd3715cfa67297e9a339a549a8f7afde4648e86b1921526cd0f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CobaltStrike

Vendor detections: 15

Intelligence 15 IOCs YARA 5 File information Comments

SHA256 hash:	9759daca251ccd3715cfa67297e9a339a549a8f7afde4648e86b1921526cd0f3
SHA3-384 hash:	b8a9ab81a0c1ed72fc9aeb937f465e14f27d72f05c4e82bc209cf79eadf96c34bde930899e169432b420b21e78ce7760
SHA1 hash:	5cd9b6cab08b5e98b93d4d1c559f5706e6fe239f
MD5 hash:	bb721fe39401bd4c679bc11118c2f347
humanhash:	butter-vegan-social-oranges
File name:	9759daca251ccd3715cfa67297e9a339a549a8f7afde4648e86b1921526cd0f3
Download:	download sample
Signature	CobaltStrike Create hunting rule
File size:	3'303'424 bytes
First seen:	2024-08-01 13:11:43 UTC
Last seen:	2024-08-01 13:31:55 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	259c038cd4434231e0e24f278026a0ea (5 x CobaltStrike, 2 x PythonStealer)
ssdeep	98304:XrByHmvoXIrWHVcQThcFkSEBz8kYDoLbZs8:XdyGvoXtKYmJMzRS8
TLSH	T180E52306A7E618FAC16B5674C9E21851FB3E7802037193EF03F466A6DF23AE05D72356
TrID	48.7% (.EXE) Win64 Executable (generic) (10523/12/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter	JAMESWT_WT
Tags:	43-143-198-113 Cobalt Strike CobaltStrike exe

Intelligence

File Origin

# of uploads :

# of downloads :

393

Origin country :

Vendor Threat Intelligence

Malware family:

cobaltstrike

ID:

File name:

9759daca251ccd3715cfa67297e9a339a549a8f7afde4648e86b1921526cd0f3

Verdict:

Malicious activity

Analysis date:

2024-08-01 13:26:31 UTC

Tags:

cobaltstrike python

Link:

https://app.any.run/tasks/9e6d5e21-353d-41cc-b6c5-97fe52a0b141

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66ab89a6b7a04efc74398cff

Tags:

Infostealer Stealth Generic

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Connection attempt

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

expand lolbin microsoft_visual_cc nuitka packed packed redcap shell32

Link:

https://www.filescan.io/uploads/66ab89b378d5c73fb1ca9d93/reports/047b56ff-5d3d-4dbe-bbf1-6c0c6061a21b/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/9759daca251ccd3715cfa67297e9a339a549a8f7afde4648e86b1921526cd0f3

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1a0d2059-01b1-4185-99c6-de910ce7a9dc

Result

Threat name:

CobaltStrike, Metasploit

Detection:

malicious

Classification:

troj

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1486046

Signature

AI detected suspicious sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Uses known network protocols on non-standard ports

Yara detected CobaltStrike

Yara detected Metasploit Payload

Behaviour

Behavior Graph:

Download SVG

Score:

92%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/9759daca251ccd3715cfa67297e9a339a549a8f7afde4648e86b1921526cd0f3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9759daca251ccd3715cfa67297e9a339a549a8f7afde4648e86b1921526cd0f3/

Threat name:

Win64.Backdoor.Cobeacon

Status:

Malicious

First seen:

2024-07-29 02:47:59 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

14 of 38 (36.84%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s5m5vsrfdtgtofopuzzjp2ndhgsutkhxv7pemshinmmscutm2dzq._file

Verdict:

malicious

Result

Malware family:

cobaltstrike

Score:

10/10

Tags:

family:cobaltstrike backdoor trojan

Link:

https://tria.ge/reports/240801-qfhfvasann/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes dropped EXE

Loads dropped DLL

Cobaltstrike

Malware Config

C2 Extraction:

http://43.143.198.113:4567/mq2M

Malware Family:

n/a

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/8fdcbf97-29e5-4137-853f-44f2c919457b

Unpacked files

SH256 hash:

9759daca251ccd3715cfa67297e9a339a549a8f7afde4648e86b1921526cd0f3

MD5 hash:

bb721fe39401bd4c679bc11118c2f347

SHA1 hash:

5cd9b6cab08b5e98b93d4d1c559f5706e6fe239f

Link:

https://www.unpac.me/results/7a457678-7aa7-43bb-a175-6944bfff183c/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9759daca251ccd3715cfa67297e9a339a549a8f7afde4648e86b1921526cd0f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	nuitka_py_compiler Create hunting rule
Author:	Nikolaos 'n0t' Totosis
Description:	Executable compiled with Nuitka Python Compiler

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Reviews

ID	Capabilities	Evidence
SHELL_API	Manipulates System Shell	SHELL32.dll::SHFileOperationW
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateProcessW KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineW KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::SetConsoleCtrlHandler KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateFileW KERNEL32.dll::GetFileAttributesW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample