MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a9ca1d6a981ccc8d8b144f337c259891a67eb6b85ee41b03699baacf4aae9a78. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
CobaltStrike
Vendor detections: 8
| SHA256 hash: | a9ca1d6a981ccc8d8b144f337c259891a67eb6b85ee41b03699baacf4aae9a78 |
|---|---|
| SHA3-384 hash: | 8b062fc3ab0a7fe72fcdf7098d0fc4c745c4885cab9380ae204f44743a6b0c502e5baabbaa08b9a00d8f51f877ffc2a0 |
| SHA1 hash: | 7ff72f27965bfb8f9de061b42250f58a57baa646 |
| MD5 hash: | 2aa86dc89fa2971bd7f9077c216e3471 |
| humanhash: | speaker-princess-lactose-monkey |
| File name: | a9ca1d6a981ccc8d8b144f337c259891a67eb6b85ee41b03699baacf4aae9a78 |
| Download: | download sample |
| Signature | CobaltStrike |
| File size: | 354'504 bytes |
| First seen: | 2020-10-05 07:41:10 UTC |
| Last seen: | 2020-10-05 08:55:08 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | ced282d9b261d1462772017fe2f6972b (127 x Formbook, 113 x GuLoader, 70 x RemcosRAT) |
| ssdeep | 6144:T9X0Gxvp9Iyla2shMf6MTnL02Hy46ntA/4Y1osXb6HK20BIVH98mKu3HTYC3:904x2yla2s1MEqg7Y1omMx3Ye |
| Threatray | 100 similar samples on MalwareBazaar |
| TLSH | E17413070390B877DE67097018FB9B79EFA5A55D32B80547D358AB2C3923B623A1D393 |
| Reporter |  JAMESWT_WT |
| Tags: | Assentor LLC CobaltStrike signed |
Intelligence
File Origin
# of uploads :
2
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a file in the %temp% subdirectories
Creating a file
Unauthorized injection to a recently created process
Sending a custom TCP request
Result
Threat name:
CobaltStrike
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to detect sleep reduction / modifications
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.TrickBot
Status:
Malicious
First seen:
2020-10-04 12:39:30 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
cobaltstrike
Similar samples:
+ 90 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Score:
10/10
Tags:
trojan backdoor family:cobaltstrike
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Cobaltstrike
Unpacked files
SH256 hash:
049d2db69cd9801a1da7143981560a2e253dc574c06c1efb5200eae28459f071
MD5 hash:
44c31e9a7af974ef873a20c3e1e14e23
SHA1 hash:
ca9725651df8a249ba80f75106442e681e77671d
SH256 hash:
1dbab09938bb8a5e76fec603fcc78bf87a9d86172d7834e0e694f36a9978b4a4
MD5 hash:
58692578062f795958f2185fc2e89188
SHA1 hash:
695cba26dd64ed6c17b0a5e436385c05c33732f4
SH256 hash:
3b8bc4742224c5327375a5f27e45071292663e9762642638a1ea1c7fddd79a93
MD5 hash:
e6a5598a7e495db3b0a6761f242857bd
SHA1 hash:
7b9bca2f0fee4958c0eb9f4f8cab533c0946e601
SH256 hash:
a9ca1d6a981ccc8d8b144f337c259891a67eb6b85ee41b03699baacf4aae9a78
MD5 hash:
2aa86dc89fa2971bd7f9077c216e3471
SHA1 hash:
7ff72f27965bfb8f9de061b42250f58a57baa646
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trickbot
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Beacon_K5om |
|---|---|
| Author: | Florian Roth |
| Description: | Detects Meterpreter Beacon - file K5om.dll |
| Reference: | https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html |
| Rule name: | CobaltStrike_Unmodifed_Beacon |
|---|---|
| Author: | yara@s3c.za.net |
| Description: | Detects unmodified CobaltStrike beacon DLL |
| Rule name: | crime_win32_csbeacon_1 |
|---|---|
| Author: | @VK_Intel |
| Description: | Detects Cobalt Strike loader |
| Reference: | https://twitter.com/VK_Intel/status/1239632822358474753 |
| Rule name: | HKTL_Meterpreter_inMemory |
|---|---|
| Author: | netbiosX, Florian Roth |
| Description: | Detects Meterpreter in-memory |
| Reference: | https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/ |
| Rule name: | Leviathan_CobaltStrike_Sample_1 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects Cobalt Strike sample from Leviathan report |
| Reference: | https://goo.gl/MZ7dRg |
| Rule name: | Malware_QA_vqgk |
|---|---|
| Author: | Florian Roth |
| Description: | VT Research QA uploaded malware - file vqgk.dll |
| Reference: | VT Research QA |
| Rule name: | PowerShell_Susp_Parameter_Combo |
|---|---|
| Author: | Florian Roth |
| Description: | Detects PowerShell invocation with suspicious parameters |
| Reference: | https://goo.gl/uAic1X |
| Rule name: | ReflectiveLoader |
|---|---|
| Description: | Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended |
| Reference: | Internal Research |
| Rule name: | SUSP_XORed_Mozilla |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious XORed keyword - Mozilla/5.0 |
| Reference: | Internal Research |
| Rule name: | WiltedTulip_ReflectiveLoader |
|---|---|
| Author: | Florian Roth |
| Description: | Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip |
| Reference: | http://www.clearskysec.com/tulip |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.