🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98ceec87cb638db932e818b0e0b72e4de6870e6aba08b172faefcc97808685cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Cobalt Strike


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98ceec87cb638db932e818b0e0b72e4de6870e6aba08b172faefcc97808685cf
SHA3-384 hash: 470186d2c93c47c28992cac57bc91c254ae744ec68f778c5d1fb6e5b17d460ebce3d9133b2ab71f7467a44a7a77c767a
SHA1 hash: 87f9c8377d643cb2d749debfc999e002201ca292
MD5 hash: 2e7c2fa8c75a99967dbf0d6ccf82d0df
humanhash: october-fish-lactose-alanine
File name:98ceec87cb638db932e818b0e0b72e4de6870e6aba08b172faefcc97808685cf
Download: download sample
Signature Cobalt Strike
Create hunting rule
File size:51'712 bytes
First seen:2024-09-10 08:52:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6603ea65ff245fea1598db6fadad400d (1 x Cobalt Strike)
ssdeep 1536:3jhX4gMZu8wcFHMESJ7qF3CNES4oqiedNRU:3jh8Zu8wcFHMESJ7q3Czgz
Threatray 3 similar samples on MalwareBazaar
TLSH T19133294BDE6216F5E4B7C23881A2B23BF9F139E64A30E70B97D551071B22770A43EB44
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter JAMESWT_WT
Tags:116-198-231-169 Cobalt Strike exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
403
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
cobaltstrike
Create hunting rule
ID:
1
File name:
98ceec87cb638db932e818b0e0b72e4de6870e6aba08b172faefcc97808685cf
Verdict:
Malicious activity
Analysis date:
2024-09-10 08:58:23 UTC
Tags:
cobaltstrike
Link:
https://app.any.run/tasks/403ca50e-0c16-4cd9-9bdb-ee9e1f9aaeac

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win64.MalwareX-gen.25695.4198.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66e008f076bc4542b0495292
Tags:
Infostealer Stealth Meterpretersc
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/66e008f0ac80a0110f673860/reports/ea9c7ace-b568-4e91-8b6c-c5bc17611753/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/98ceec87cb638db932e818b0e0b72e4de6870e6aba08b172faefcc97808685cf
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c1358005-2a3a-4442-98f5-570d9537f4a3
Result
Threat name:
CobaltStrike, Metasploit
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1508522
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Yara detected Metasploit Payload
Behaviour
Behavior Graph:
Download SVG
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/98ceec87cb638db932e818b0e0b72e4de6870e6aba08b172faefcc97808685cf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/98ceec87cb638db932e818b0e0b72e4de6870e6aba08b172faefcc97808685cf/
Threat name:
Win64.Backdoor.MeterpreterReverseShell
Create hunting rule
Status:
Malicious
First seen:
2024-06-22 13:01:00 UTC
File Type:
PE+ (Exe)
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tdhozb6lmog3smxidcyobnzojxtiodtkxielc4x257gjpaegqxhq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
915cc233f5c3b36f2aa5a9a0aa2fcd28b8ee406e42c08b71177dab901c219d41
Cobalt Strike
98ceec87cb638db932e818b0e0b72e4de6870e6aba08b172faefcc97808685cf
Cobalt Strike
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/240910-ktap9svgnl/
Malware Family:
n/a
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ec20900f-2d21-4d57-b71f-ca539a0ced7c
Unpacked files
SH256 hash:
98ceec87cb638db932e818b0e0b72e4de6870e6aba08b172faefcc97808685cf
MD5 hash:
2e7c2fa8c75a99967dbf0d6ccf82d0df
SHA1 hash:
87f9c8377d643cb2d749debfc999e002201ca292
Link:
https://www.unpac.me/results/f644103d-e3d0-4390-a5d8-e6b7739d2a45/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/98ceec87cb638db932e818b0e0b72e4de6870e6aba08b172faefcc97808685cf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryA

Comments