MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2921f802aabf290fc4ce217d7c0bab761db7269677dad7e2ee006bd74bf83e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CobaltStrike

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	a2921f802aabf290fc4ce217d7c0bab761db7269677dad7e2ee006bd74bf83e2
SHA3-384 hash:	9615c7b2fbdda651539bef2686e2c9f913a11d72faf54fdcbdb44115c7541b98ed0e6eb926d09d6a24516281a8d95adb
SHA1 hash:	c9f0aeaa5e20e179f4c3c92639f846a445ebc061
MD5 hash:	bd7a79dbbdb34ad834e9798407f48ce9
humanhash:	four-hotel-item-three
File name:	Detailed Explanation of AS Relationships and the Impact of BGP Flapping on Upstream Networks.pdf.lnk
Download:	download sample
Signature	CobaltStrike Create hunting rule
File size:	948 bytes
First seen:	2024-12-12 14:55:32 UTC
Last seen:	2024-12-12 17:04:49 UTC
File type:	lnk
MIME type:	application/octet-stream
ssdeep	24:8SjhSHC+li6syQdAZP+IMWfY4I0+2b5fy+cImgp:8SjgHPsVWZXM0nIZE5HPT
TLSH	T1051125484BEFEB26C622423648A7E310463BB859F5A94B7C11EC03C4DCFD1001529F3B
Magika	lnk
Reporter	abuse_ch
Tags:	CHE Cobalt Strike CobaltStrike DetailedExplanationofASRelationships geo lnk

abuse_ch

Cobalt Strike C2:
https://onnetmais.org/onnetmais/tcl_sync.js

Intelligence

File Origin

# of uploads :

# of downloads :

160

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30517.LnkHeur.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=675afab64bc1eb3cc1ef39df

Tags:

spawn blic sage

Result

Verdict:

Malicious

File Type:

LNK File - Malicious

Link:

https://app.docguard.net/a2921f802aabf290fc4ce217d7c0bab761db7269677dad7e2ee006bd74bf83e2/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

explorer lolbin masquerade

Link:

https://www.filescan.io/uploads/675af98e17fbc31114c22cf5/reports/ace1eacc-e584-4e02-b36d-78176494b3f0/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/a2921f802aabf290fc4ce217d7c0bab761db7269677dad7e2ee006bd74bf83e2

Result

Threat name:

n/a

Detection:

suspicious

Classification:

evad

Score:

21 / 100

Link:

https://www.joesandbox.com/analysis/1573796

Signature

Uses an obfuscated file name to hide its real file extension (double extension)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a2921f802aabf290fc4ce217d7c0bab761db7269677dad7e2ee006bd74bf83e2/

Threat name:

Shortcut.Trojan.Generic

Status:

Suspicious

First seen:

2024-12-12 14:56:05 UTC

File Type:

Binary

AV detection:

4 of 24 (16.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ukjb7abkvpzjb7cm4il5pqf2w5q5w4tjm56227ro4adl25f7qpra._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/241212-sa124szkhr/

Behaviour

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Network Configuration Discovery: Internet Connection Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Pay2Key

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a2921f802aabf290fc4ce217d7c0bab761db7269677dad7e2ee006bd74bf83e2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	EXE_in_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies executable artefacts in shortcut (LNK) files.

Rule name:	Long_RelativePath_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies shortcut (LNK) file with a long relative path. Might be used in an attempt to hide the path.