🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9bfd61a00155017d1a6768326549c65ea9bbe8884b92a7a013e97b507a9167ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Cobalt Strike


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9bfd61a00155017d1a6768326549c65ea9bbe8884b92a7a013e97b507a9167ff
SHA3-384 hash: d76001322c58fb0d630d8c64ca8aa54f0dcb4eaf8583790b79ffee85c5b1e69cb84b944d8248c4130324f75dd6021668
SHA1 hash: 00e04653569a6d8244edff8765deec3d6ed9c15f
MD5 hash: d19f3280851b5e9510a63fe7c80466ae
humanhash: mobile-moon-paris-ohio
File name:9bfd61a00155017d1a6768326549c65ea9bbe8884b92a7a013e97b507a9167ff
Download: download sample
Signature Cobalt Strike
Create hunting rule
File size:67'584 bytes
First seen:2024-09-10 08:52:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6102f16ed129485447b57b8b35734f82 (1 x Cobalt Strike)
ssdeep 1536:mWHMTN/JJ86S4oqiEcpI6rAz/saT4c6WuC0J8:mWIJ8L1U/T4c6W70J8
TLSH T1D963BF9A7B428CFEE95613388123A49EF3F27C111B22ABFF47C601552D633D96C7A650
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
File icon (PE):PE icon
dhash icon 2848c9d999d8d03a (1 x Cobalt Strike)
Reporter JAMESWT_WT
Tags:116-198-231-169 Cobalt Strike exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
408
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
cobaltstrike
Create hunting rule
ID:
1
File name:
9bfd61a00155017d1a6768326549c65ea9bbe8884b92a7a013e97b507a9167ff
Verdict:
Malicious activity
Analysis date:
2024-09-10 08:53:26 UTC
Tags:
cobaltstrike
Link:
https://app.any.run/tasks/e09d9f26-0572-47fa-aa34-12313c5d27f0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.W64.ABTrojan.DNST-3698.6778.11891.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66e008ee751db35a8b9f661e
Tags:
Infostealer Stealth Rozena
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm microsoft_visual_cc packed rozena
Link:
https://www.filescan.io/uploads/66e008efadc6c63aa37dcdb1/reports/7a839278-3eb2-4bc1-8d48-95562a260076/overview
Verdict:
Malicious
Labled as:
TR/AD.PatchedWinSwrort
Link:
https://www.hybrid-analysis.com/sample/9bfd61a00155017d1a6768326549c65ea9bbe8884b92a7a013e97b507a9167ff
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e531ccd3-9485-47e4-9ed8-c9c58738e552
Result
Threat name:
CobaltStrike, Metasploit
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1508523
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Yara detected Metasploit Payload
Behaviour
Behavior Graph:
Download SVG
Score:
93%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9bfd61a00155017d1a6768326549c65ea9bbe8884b92a7a013e97b507a9167ff
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9bfd61a00155017d1a6768326549c65ea9bbe8884b92a7a013e97b507a9167ff/
Threat name:
Win64.Backdoor.Cobeacon
Create hunting rule
Status:
Malicious
First seen:
2024-09-01 10:47:02 UTC
File Type:
PE+ (Exe)
Extracted files:
8
AV detection:
11 of 38 (28.95%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tp6wdiabkuax2gthnazgksogl2u3x2eijojkpiat5f5va6urm77q._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/240910-ktaehavgnk/
Malware Family:
n/a
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/8bf548f0-447e-4c2e-bc10-0bad83288dab
Unpacked files
SH256 hash:
9bfd61a00155017d1a6768326549c65ea9bbe8884b92a7a013e97b507a9167ff
MD5 hash:
d19f3280851b5e9510a63fe7c80466ae
SHA1 hash:
00e04653569a6d8244edff8765deec3d6ed9c15f
Link:
https://www.unpac.me/results/3b0656d7-a0ee-438f-81c6-bf3209d5af33/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9bfd61a00155017d1a6768326549c65ea9bbe8884b92a7a013e97b507a9167ff

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_APICan Execute other programsapi-ms-win-crt-runtime-l1-1-0.dll::_get_narrow_winmain_command_line

Comments