MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9efe830686c8849fdd7bb62ebce4ff3659788c6b48b636040443009c02fd0d71. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9efe830686c8849fdd7bb62ebce4ff3659788c6b48b636040443009c02fd0d71
SHA3-384 hash:	70028e6efcf02e96636b79c39903bfb8c38154d946d073fdd41f29680673558e6b1bf6f3a9d6f058e7dcfcafee3b4a9b
SHA1 hash:	b859aeef79f485665adb0b4bf29098c05aab974b
MD5 hash:	fb521a291f7e440dd5d519863ad273b4
humanhash:	pizza-pip-artist-hamper
File name:	dino_http_x86.exe
Download:	download sample
Signature	CobaltStrike Alert Create hunting rule
File size:	13'824 bytes
First seen:	2023-12-21 21:26:20 UTC
Last seen:	2023-12-21 23:19:08 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	019b571cd12272b16e59c82a4a2ecb9a (1 x CobaltStrike)
ssdeep	192:f3bwK//GwW0UynyoyNRzQGio/zZSOX6NOasZQe8DgNJ:T1ejnynANmyNSFfeRNJ
Threatray	1 similar samples on MalwareBazaar
TLSH	T17E52E659E51368B2E5165CF088FBEBB59F73FAA24CB08438FF5CE8952B10720795B205
TrID	32.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 20.5% (.EXE) Win64 Executable (generic) (10523/12/4) 12.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 9.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	James_inthe_box
Tags:	Cobalt Strike exe

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

471

Origin country :

US

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

9efe830686c8849fdd7bb62ebce4ff3659788c6b48b636040443009c02fd0d71.zip

Verdict:

No threats detected

Analysis date:

2023-12-21 21:33:43 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/9f8a7b2f-304f-4520-946b-d158ec0a5cf1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/468882/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.TrojanX-gen.10300.25296.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  0/10

Confidence:

100%

Tags:

anti-debug

Link:

https://www.filescan.io/uploads/6584ada8b855eb3693ec1c50/reports/210ef45d-d93e-43ce-bfd2-59975c1fde01/overview

Hybrid Analysis DeepScan:Generic.ShellCode.Marte.1

Verdict:

Malicious

Labled as:

DeepScan:Generic.ShellCode.Marte.1

Link:

https://www.hybrid-analysis.com/sample/9efe830686c8849fdd7bb62ebce4ff3659788c6b48b636040443009c02fd0d71

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Cobalt Strike

Malware family:

Cobalt Strike

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/05eb0ba4-7ddf-47e4-91a8-c16ef905275e

Joe Sandbox CobaltStrike, Metasploit

Result

Threat name:

CobaltStrike, Metasploit

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1365852

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Found malware configuration

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected CobaltStrike

Yara detected Metasploit Payload

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

57%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/9efe830686c8849fdd7bb62ebce4ff3659788c6b48b636040443009c02fd0d71

CERT.PL MWDB cobaltstrike

Detection:

cobaltstrike

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/9efe830686c8849fdd7bb62ebce4ff3659788c6b48b636040443009c02fd0d71/

ReversingLabs TitaniumCloud Win32.Trojan.Swrort

Threat name:

Win32.Trojan.Swrort

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-21 21:26:13 UTC

File Type:

PE (Exe)

AV detection:

14 of 37 (37.84%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=t37igbugzccj7xl3wyxlzzh7gzmxrddljc3dmbaeimajyax5bvyq._file

Threatray cobaltstrike

Verdict:

malicious

Label(s):

cobaltstrike

Alert

Create hunting rule

Similar samples:

9efe830686c8849fdd7bb62ebce4ff3659788c6b48b636040443009c02fd0d71

CobaltStrike

Hatching Triage cobaltstrike

Result

Malware family:

cobaltstrike

Alert

Create hunting rule

Score:

  10/10

Tags:

family:cobaltstrike backdoor trojan

Link:

https://tria.ge/reports/231221-1aqv5sfdbm/

Behaviour

Cobaltstrike

UnpacMe

Unpacked files

SH256 hash:

9efe830686c8849fdd7bb62ebce4ff3659788c6b48b636040443009c02fd0d71

MD5 hash:

fb521a291f7e440dd5d519863ad273b4

SHA1 hash:

b859aeef79f485665adb0b4bf29098c05aab974b

Link:

https://www.unpac.me/results/f8ce6add-a001-42b0-8207-5da3e553d508/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9efe830686c8849fdd7bb62ebce4ff3659788c6b48b636040443009c02fd0d71

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

  

Delivery method

Other

Cape

https://www.capesandbox.com/analysis/468882/