MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b151876e8b4405344dcbf1c7738be9f93f2cf2cc0cde9ba18d73fa443f460ecd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Cobalt Strike

Vendor detections: 18

Intelligence 18 IOCs YARA 10 File information Comments

SHA256 hash:	b151876e8b4405344dcbf1c7738be9f93f2cf2cc0cde9ba18d73fa443f460ecd
SHA3-384 hash:	6b31fa6de9dd9b839ca856133f2629ada7c318e13cada837f84b5e4840b02db56592d57aa0f06c7329b302526ccea7ee
SHA1 hash:	ea0e48d2dededa100b57dc62a75baa60a8e32f57
MD5 hash:	5c74e515750a07cd1800406809bccdfe
humanhash:	winter-hamper-sierra-wyoming
File name:	file
Download:	download sample
Signature	Cobalt Strike Create hunting rule
File size:	73'802 bytes
First seen:	2024-09-20 13:46:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	481f47bbb2c9c21e108d65f52b04c448 (257 x Meterpreter, 93 x Metasploit, 33 x ShikataGaNai)
ssdeep	1536:IDlgtBH7PCMhK2x68SVoe7PsStwLZhOGwMb+KR0Nc8QsJq39:ltBTCMhKhVocsStiYe0Nc8QsC9
Threatray	117 similar samples on MalwareBazaar
TLSH	T1FC73CF82EDC01425D1A5233D277137B9AA76F5F63505C2DA7A8CCDE8DBD18B092363C6
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10523/12/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	jstrosch
Tags:	Cobalt Strike CobaltStrike exe Metasploit ReflectiveLoader

jstrosch

Found at hxxp://89.197.154[.]116/Extension.exe by #subcrawl

Intelligence

File Origin

# of uploads :

# of downloads :

399

Origin country :

Vendor Threat Intelligence

Malware family:

meterpreter

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2024-09-20 13:59:18 UTC

Tags:

meterpreter backdoor metasploit cobaltstrike

Link:

https://app.any.run/tasks/505060ae-9bc3-4c6e-850d-2c77725e2ad3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Trojan.Swrort-5710536-0

BC.Win.Trojan.Swrort-17210

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66ed7cdb1db25d66857c59f9

Tags:

Encryption Network Static Stealth

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Connection attempt

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

cobalt lolbin microsoft_visual_cc overlay packed remote

Link:

https://www.filescan.io/uploads/66ed7cdabb9fe02b41b50af7/reports/7b0ecfa5-c10a-43bd-86d8-11c34e82ecce/overview

Verdict:

Malicious

Labled as:

Trojan.CryptZ.Marte.1

Link:

https://www.hybrid-analysis.com/sample/b151876e8b4405344dcbf1c7738be9f93f2cf2cc0cde9ba18d73fa443f460ecd

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Cobalt Strike

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e090a8e4-8361-4db6-a088-d9081a3a6517

Result

Threat name:

CobaltStrike, Metasploit, ReflectiveLoad

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1514519

Signature

AI detected suspicious sample

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CobaltStrike

Yara detected Metasploit Payload

Yara detected Powershell download and execute

Yara detected ReflectiveLoader

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/b151876e8b4405344dcbf1c7738be9f93f2cf2cc0cde9ba18d73fa443f460ecd

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b151876e8b4405344dcbf1c7738be9f93f2cf2cc0cde9ba18d73fa443f460ecd/

Threat name:

Win32.Backdoor.Swrort

Status:

Malicious

First seen:

2024-09-20 09:10:21 UTC

File Type:

PE (Exe)

AV detection:

33 of 38 (86.84%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wfiyo3uliqctitol6hdxhc7j7e7sz4wmbtpjximnop5eip2gb3gq._file

Verdict:

malicious

Label(s):

metasploit

cobaltstrike

Cobalt Strike

69b2c233d4fdb8080ed851c14f8d35bbf2a1d0722b9fcd25881cef408c03cc31

Cobalt Strike

b151876e8b4405344dcbf1c7738be9f93f2cf2cc0cde9ba18d73fa443f460ecd

Cobalt Strike

+ 107 additional samples on MalwareBazaar

Result

Malware family:

metasploit

Score:

10/10

Tags:

family:cobaltstrike family:metasploit backdoor discovery trojan

Link:

https://tria.ge/reports/240920-q3h1wszalg/

Behaviour

System Location Discovery: System Language Discovery

Cobaltstrike

MetaSploit

Malware Config

C2 Extraction:

http://89.197.154.116:7810/huGC1aTx6yf7CvoLneazWgnuOQe879sh

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/69838f62-bb3f-46f6-a87a-7b19903aacb1

Unpacked files

SH256 hash:

b151876e8b4405344dcbf1c7738be9f93f2cf2cc0cde9ba18d73fa443f460ecd

MD5 hash:

5c74e515750a07cd1800406809bccdfe

SHA1 hash:

ea0e48d2dededa100b57dc62a75baa60a8e32f57

Detections:

SUSP_Imphash_Mar23_2

CobaltStrike_Resources_Httpsstager_Bin_v2_5_through_v4_x

Link:

https://www.unpac.me/results/3d737511-596c-4e78-b697-fd12a91de247/

Malware family:

CobaltStrike

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b151876e8b44/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

CobaltStrike

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b151876e8b4405344dcbf1c7738be9f93f2cf2cc0cde9ba18d73fa443f460ecd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CobaltStrikeStager Create hunting rule
Author:	@dan__mayer <daniel@stairwell.com>
Description:	Cobalt Strike Stager Payload

Rule name:	CobaltStrike_Resources_Httpsstager_Bin_v2_5_through_v4_x Create hunting rule
Author:	gssincla@google.com
Description:	Cobalt Strike's resources/httpsstager.bin signature for versions 2.5 to 4.x
Reference:	https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse

Rule name:	CobaltStrike__Resources_Httpsstager_Bin_v2_5_through_v4_x Create hunting rule
Author:	gssincla@google.com

Rule name:	Detect_APT29_WINELOADER_Backdoor Create hunting rule
Author:	daniyyell
Description:	Detects APT29's WINELOADER backdoor variant used in phishing campaigns, this rule also detect bad pdf,shtml,htm and vbs or maybe more depends
Reference:	https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties

Rule name:	Detect_Malicious_VBScript_Base64 Create hunting rule
Author:	daniyyell
Description:	Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	SUSP_Imphash_Mar23_2 Create hunting rule
Author:	Arnim Rupp (https://github.com/ruppde)
Description:	Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
Reference:	Internal Research

Rule name:	Windows_Trojan_Metasploit_24338919 Create hunting rule
Author:	Elastic Security
Description:	Identifies metasploit wininet reverse shellcode. Also used by other tools (like beacon).

Rule name:	Windows_Trojan_Metasploit_96233b6b Create hunting rule
Author:	Elastic Security
Description:	Identifies another 64 bit API hashing function used by Metasploit.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Cobalt Strike

exe b151876e8b4405344dcbf1c7738be9f93f2cf2cc0cde9ba18d73fa443f460ecd

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/3101638/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::AllocateAndInitializeSid ADVAPI32.dll::FreeSid
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::SetStdHandle
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileA KERNEL32.dll::CreateFileW
WIN_SOCK_API	Uses Network to send and receive data	WS2_32.dll::WSARecv WS2_32.dll::WSASend

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample