MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa71d1f8581296304caf7f0a046273e1db94101509319733dc973500dd03fdec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 14


Intelligence 14 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa71d1f8581296304caf7f0a046273e1db94101509319733dc973500dd03fdec
SHA3-384 hash: e5b8ed7b4f0d8eb40bff44578fc47669138e73663dc6946d2ecd58574bef6eb79537a6b7af383dae78b58a1d85d4f6d9
SHA1 hash: 6d9ce310dc1102dd1cdbbd898a983fa099939808
MD5 hash: 8e6f98c28b27346dbc0c4077e6a4e3d9
humanhash: california-illinois-summer-pluto
File name:cs.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:228'864 bytes
First seen:2022-03-11 17:12:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 829da329ce140d873b4a8bde2cbfaa7e (259 x CobaltStrike)
ssdeep 6144:b443XR4S38C4BeBxi66thkbAzLks1YarGR8ej4rC5B/:3MZMBIz+YLks1YarGR8Pu/
Threatray 173 similar samples on MalwareBazaar
TLSH T10E24CFB0B41DBDA5F08B46B60D4EF0B2AD50EED7A99EA61B70F4A40597CA573340F603
Reporter drb_ra
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cobaltstrike_shellcode.exe
Verdict:
No threats detected
Analysis date:
2022-03-11 17:12:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c56de99a-6f53-4147-b9b1-2efc113f5f50

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/249567/
Detection(s):
Win.Exploit.D3b71c-9863766-0
Create hunting rule

SecuriteInfo.com.Crypt5.BLLV.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/8890/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug obfuscated
Link:
https://www.filescan.io/uploads/622b83230cd58dbd927fa2f8/reports/76df4d34-fa61-4b21-b7d4-5677b73ed59a/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Cobalt Strike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4d7f1fd7-d077-4f2b-a31c-4ef804dea1c0
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/955183
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
cobaltstrike
Create hunting rule
Link:
https://mwdb.cert.pl/sample/aa71d1f8581296304caf7f0a046273e1db94101509319733dc973500dd03fdec/
Threat name:
Win32.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2022-03-11 17:13:10 UTC
File Type:
PE (Exe)
AV detection:
25 of 27 (92.59%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vjy5d6cyckldatfpp4faiytt4hnzieavbeyzom64s42qbxid7xwa._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
0b4ebf0528180d7b88c4ccbd9a5364a46383edcccf0364045ee6d9d0555b63d1
CobaltStrike
3503cc8b2b33ef3f14724bec7e7c8860786f9b62174e1cd87b4ae679ecf8d401
CobaltStrike
56be4a35ec8ab2e47e326b153c690716d929dcad04421f0723cc2aaa250ec226
CobaltStrike
72e8bc12f384636fc86ced4c1d53f584e9ad4b6acd29748a59845e9cb631ff60
CobaltStrike
b4f6c11f8821d7f8463f29cb85ac120c21f4f55a69b5bc85fbe0bf691de472a8
CobaltStrike
c7f90e07d571707c42557c6169817834d791c438e964878729c941733b3c8ca6
CobaltStrike
+ 163 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:505417884
Link:
https://tria.ge/reports/220311-vreljsdeaj/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Malware Config
C2 Extraction:
http://www.menshealth.co.uk:443/safebrowsing/fp/jxPkCmu1ULjh5eFFY72OuY
Unpacked files
SH256 hash:
aa71d1f8581296304caf7f0a046273e1db94101509319733dc973500dd03fdec
MD5 hash:
8e6f98c28b27346dbc0c4077e6a4e3d9
SHA1 hash:
6d9ce310dc1102dd1cdbbd898a983fa099939808
Link:
https://www.unpac.me/results/c63156de-6bdf-4584-86dd-7227a7ebce55/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aa71d1f8581296304caf7f0a046273e1db94101509319733dc973500dd03fdec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobaltbaltstrike_strike_Payload_XORed
Create hunting rule
Author:Avast Threat Intel Team
Description:Detects CobaltStrike payloads
Reference:https://github.com/avast/ioc
Rule name:CobaltStrikeBeacon
Create hunting rule
Author:ditekshen, enzo & Elastic
Description:Cobalt Strike Beacon Payload
Rule name:CobaltStrike_C2_Encoded_XOR_Config_Indicator
Create hunting rule
Author:yara@s3c.za.net
Description:Detects CobaltStrike C2 encoded profile configuration
Rule name:HKTL_CobaltStrike_Beacon_Strings
Create hunting rule
Author:Elastic
Description:Identifies strings used in Cobalt Strike Beacon DLL
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5
Create hunting rule
Author:Florian Roth
Description:Detects strings found in CobaltStrike shellcode
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Rule name:HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5_RID361D
Create hunting rule
Author:Florian Roth
Description:Detects strings found in malware samples in APT report in DarkHydrus
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Rule name:malware_CobaltStrike_v3v4
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect CobaltStrike Beacon in memory
Reference:https://blogs.jpcert.or.jp/en/2018/08/volatility-plugin-for-detecting-cobalt-strike-beacon.html
Rule name:SUSP_XORed_Mozilla
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:XOREngine_Misc_XOR_Func
Create hunting rule
Author:smiller cc @florian @wesley idea on implementation with yara's built in XOR function
Description:Use with care, https://twitter.com/cyb3rops/status/1237042104406355968

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/249567/

Comments