🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae63cd0a53cbefb25fa2a48194404ba5facd7b8029a9fe9a6ccd36a11577c9e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 6


Intelligence 6 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae63cd0a53cbefb25fa2a48194404ba5facd7b8029a9fe9a6ccd36a11577c9e9
SHA3-384 hash: 32ac34acd7d211ed6015263bcc3aba3032c4a35192b13bf3184b246ba7623e5d61c70ebea1b45ded7fa0ee0d85ad2ad2
SHA1 hash: 4cff03168fbd5826ccfcf00903526f768b0cf0dc
MD5 hash: 3cbe63e81013b26c4c9aa46fac4af1cb
humanhash: south-twelve-cola-lactose
File name:ae63cd0a53cbefb25fa2a48194404ba5facd7b8029a9fe9a6ccd36a11577c9e9
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:211'283 bytes
First seen:2020-11-10 07:23:23 UTC
Last seen:2024-07-24 20:17:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa9c4c247b9d54feb65b7fae02f433a (24 x CobaltStrike)
ssdeep 3072:pILM+43c22IEY2whhnO9I+N5RflK2OQRNXHVcLbR1jjZURwz25vw6Ex:i/22Ib2YO9ZI2OYIbRBjmwSbEx
Threatray 137 similar samples on MalwareBazaar
TLSH 5B24AFE13181D576C04A0035664FCB7E9BB9B8F459B0D4C7FF984A999E716A3CA3A303
Reporter seifreed
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
3
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.CobaltStrike-8091534-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ae63cd0a53cbefb25fa2a48194404ba5facd7b8029a9fe9a6ccd36a11577c9e9/
Threat name:
Win32.PUA.CobaltStrikeBeacon
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 07:28:23 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vzr42cstzpx3ex5cusaziqclux5m264afgu75gtmzu3kcflxzhuq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
19ef6a3ce60b67cc2f308bc56d3529d2d5ae3454f4e727d746bd8fb1a8ae0fe4
CobaltStrike
1d7dd6d8454853a489cb20618172f5d0d08615aba118176183f6dbeb0c73f218
CobaltStrike
2e7403807afe677a28efe5dbbf2b48edafa90cac07ff2756def2044cf0d19684
CobaltStrike
3f9805063f7cb10f5500b76121fa27a62f5bc97eb6944cc8608400631595231f
CobaltStrike
46bbcc6fde17df7a4ae20797371415a8e3a51346cd5ceee2487e7add0afc8046
CobaltStrike
5debce25fe4c1ca38a79521abb5bb3b88b5d8b24bc0f564373d04371c4d6dd46
CobaltStrike
623ec9739a929c33ce48d82a53cecc9c2dedd8f91be9c222e7f5301b53743887
CobaltStrike
87a74ec523b3f466e698f08721faa276448783f6f1a81a1679a8854668ac2427
CobaltStrike
d9de56210ee0ad4b6c95e450d9c8d41e9141895f41793f7eec5cf6350966583b
CobaltStrike
e6f62e3e17dfa2b0497ee9a12a7b16b6644fbab3eae73caef0841a8a0c47f2ef
CobaltStrike
+ 127 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike
Link:
https://tria.ge/reports/201110-x3e2ramv62/
Behaviour
Suspicious use of WriteProcessMemory
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_CobaltStrike_Beacon_Indicator
Create hunting rule
Author:JPCERT
Description:Detects CobaltStrike beacons
Reference:https://github.com/JPCERTCC/aa-tools/blob/master/cobaltstrikescan.py
Rule name:CobaltStrike
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect CobaltStrike Beacon in memory
Reference:https://blogs.jpcert.or.jp/en/2018/08/volatility-plugin-for-detecting-cobalt-strike-beacon.html
Rule name:CobaltStrikeBeacon
Create hunting rule
Author:enzo
Description:Cobalt Strike Beacon Payload
Rule name:CobaltStrike_C2_Encoded_Config_Indicator
Create hunting rule
Author:yara@s3c.za.net
Description:Detects CobaltStrike C2 encoded profile configuration
Rule name:CobaltStrike_Sleep_Decoder_Indicator
Create hunting rule
Author:yara@s3c.za.net
Description:Detects CobaltStrike sleep_mask decoder
Rule name:CobaltStrike_Unmodifed_Beacon
Create hunting rule
Author:yara@s3c.za.net
Description:Detects unmodified CobaltStrike beacon DLL
Rule name:crime_win32_csbeacon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Cobalt Strike loader
Reference:https://twitter.com/VK_Intel/status/1239632822358474753
Rule name:HKTL_Meterpreter_inMemory
Create hunting rule
Author:netbiosX, Florian Roth
Description:Detects Meterpreter in-memory
Reference:https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Rule name:ReflectiveLoader
Create hunting rule
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:SUSP_XORed_Mozilla
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:WiltedTulip_ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:http://www.clearskysec.com/tulip

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments