MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae4dcd24be60dbdaa920b2e11a78a01b38ee59f4500030f8156e2d1ffac8cf38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CobaltStrike

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	ae4dcd24be60dbdaa920b2e11a78a01b38ee59f4500030f8156e2d1ffac8cf38
SHA3-384 hash:	c0d35218cf4641b7844cc74f9d74f12c2ca1b32ad45f7b6da123371986fb8bc128ed324caf8ee5a09fa69eee2b68512e
SHA1 hash:	c145b3af3f129d86b292c2f650830077f24eb348
MD5 hash:	0f14de87602eb0ef7f5e5dfaab5a152f
humanhash:	stream-alaska-twenty-mirror
File name:	LisectAVT_2403002C_178.exe
Download:	download sample
Signature	CobaltStrike Create hunting rule
File size:	19'456 bytes
First seen:	2024-07-25 01:45:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	147442e63270e287ed57d33257638324 (161 x CobaltStrike, 22 x Cobalt Strike)
ssdeep	192:aV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/29/6fbrWF8qa1Dojjgi:0qaCF31cix+Dc4zj+62FF46gi
TLSH	T17792FB3FE71368E9C106D57845FB7733DCB23DB385A6571E2724D2B42E106A42E6E610
TrID	41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 26.1% (.EXE) Win64 Executable (generic) (10523/12/4) 12.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.1% (.ICL) Windows Icons Library (generic) (2059/9) 5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	Anonymous
Tags:	Cobalt Strike exe

Anonymous

this malware sample is very nasty!

Intelligence

File Origin

# of uploads :

# of downloads :

233

Origin country :

Vendor Threat Intelligence

Detection(s):

Win.Countermeasure.LoaderWinGeneric-9804845-2

Win.Trojan.CobaltStrike-7899871-1

Win.Trojan.CobaltStrike-9044898-1

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug cobalt cobaltstrike

Link:

https://www.filescan.io/uploads/66a1ae603ba51bb345a37513/reports/30736982-ac32-4380-bebf-f92341e76207/overview

Result

Threat name:

CobaltStrike, Metasploit

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1481399

Behaviour

Behavior Graph:

n/a

Score:

96%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/ae4dcd24be60dbdaa920b2e11a78a01b38ee59f4500030f8156e2d1ffac8cf38

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ae4dcd24be60dbdaa920b2e11a78a01b38ee59f4500030f8156e2d1ffac8cf38/

Threat name:

Win64.Backdoor.CobaltStrike

Status:

Malicious

First seen:

2024-03-24 23:16:09 UTC

File Type:

PE+ (Exe)

AV detection:

30 of 38 (78.95%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vzg42jf6mdn5vkjawlqru6fadm4o4wpukaadb6avnywr76wiz44a._file

Verdict:

malicious

Label(s):

cobaltstrike

Result

Malware family:

cobaltstrike

Score:

10/10

Tags:

family:cobaltstrike backdoor trojan

Link:

https://tria.ge/reports/240725-b6h3qstfna/

Behaviour

Cobaltstrike

Malware Config

C2 Extraction:

http://172.18.0.1:80/4qJn

Malware Family:

n/a

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/3fb9d923-35e7-4e7d-9a37-925495a91297

Unpacked files

SH256 hash:

ae4dcd24be60dbdaa920b2e11a78a01b38ee59f4500030f8156e2d1ffac8cf38

MD5 hash:

0f14de87602eb0ef7f5e5dfaab5a152f

SHA1 hash:

c145b3af3f129d86b292c2f650830077f24eb348

Link:

https://www.unpac.me/results/2deace24-a02f-4fa6-8477-79bc5154e8bf/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Windows_Trojan_CobaltStrike_7f8da98a Create hunting rule
Author:	Elastic Security

Rule name:	win_cobaltstrike_pipe_strings_nov_2023 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects default strings related to cobalt strike named pipes

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

CobaltStrike

exe ae4dcd24be60dbdaa920b2e11a78a01b38ee59f4500030f8156e2d1ffac8cf38

(this sample)

Link

https://bbs.kafan.cn/forum-31-1.html

Delivery method

Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::GetStartupInfoA
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample