MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b40c8fcb20acf66db418078f0d6099145b220dc056d095beb54665faf6c726c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 4


Intelligence 4 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b40c8fcb20acf66db418078f0d6099145b220dc056d095beb54665faf6c726c7
SHA3-384 hash: 9fc21b121c04b97c0b9980658c707ff19ef97e25f738b2e51937d97f1c7cf3754799004477f1d13d2cf7463b8db0c6c7
SHA1 hash: d6c925571fc4b21663d86130d4ff96b7676740ce
MD5 hash: 139d68d27d8be0694c797fba126ac9f8
humanhash: venus-shade-bluebird-romeo
File name:139d68d27d8be0694c797fba126ac9f8.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:284'160 bytes
First seen:2020-06-11 16:10:11 UTC
Last seen:2020-06-11 16:45:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 14c880d25a4c148062626b35d23ad003 (2 x CobaltStrike)
ssdeep 6144:gJTt+25C+sj2D3lxR1IZ/YNT3VS4UXe6Wm7EcVEojuc313r:gNt+WC+G2D3lxR1I2S4+e6Wm4cJiy3
Threatray 64 similar samples on MalwareBazaar
TLSH 7A54CF36DFDB62B2C89762F310C3B67577787A611832732D8A8358CD4291C167CB39A9
Reporter oppimaniac
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
2
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/9043/
Detection(s):
SecuriteInfo.com.Trojan.Siggen7.54626.22402.10374.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Cometer
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 16:12:07 UTC
AV detection:
27 of 30 (90.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wqgi7szavt3g3naya6hq2yezcrnsedoak3ijlpvvizs7v5whe3dq._file
Verdict:
malicious
Similar samples:
178bba892544670c9b347112461fc5443e02bd5a7685c9c29a4218dcf64eb25c
CobaltStrike
1a9bbebde954b27cbf6006128e1a22bdfa81d4ea853ba99bab4ec3333ea0bb89
CobaltStrike
2610754a99eb906bc26243eff669ca156c0b0cfb56875fc93ec17a607c95cfb4
CobaltStrike
514de96ef99941a0c9712622848b687b402b0635a4bb45cf1cee0002fe8cdfcd
CobaltStrike
8b855b57f8cd532db46946a38f929e5e5d43d7c1c5ea09a5b51c21097143a282
CobaltStrike
9a8b757fa40f9f6ee20d070db2801a48b9f7129ca385d6b52bb754cc8b72920b
CobaltStrike
a2c804408646e8c0481d3ba30a49482721857f540ecabc32c1de77cb91860c64
CobaltStrike
dff1da3407eaf5a16558d8561b42720d9382dbbee8b9169847a6e1560b4250df
CobaltStrike
e571cd3a4c0744cb3c5443b868577adced331a7545fcb6e2ed0efbe7506a2f9b
CobaltStrike
fb01851fc2be012833865bd37f81fa98f6a27131bb660e5b01c5eedb8070ceab
CobaltStrike
+ 54 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-7km412s9yj/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Beacon_K5om
Create hunting rule
Author:Florian Roth
Description:Detects Meterpreter Beacon - file K5om.dll
Reference:https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html
Rule name:CobaltStrike_Unmodifed_Beacon
Create hunting rule
Author:yara@s3c.za.net
Description:Detects unmodified CobaltStrike beacon DLL
Rule name:Leviathan_CobaltStrike_Sample_1
Create hunting rule
Author:Florian Roth
Description:Detects Cobalt Strike sample from Leviathan report
Reference:https://goo.gl/MZ7dRg
Rule name:Malware_QA_vqgk
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file vqgk.dll
Reference:VT Research QA
Rule name:PowerShell_Susp_Parameter_Combo
Create hunting rule
Author:Florian Roth
Description:Detects PowerShell invocation with suspicious parameters
Reference:https://goo.gl/uAic1X
Rule name:ReflectiveLoader
Create hunting rule
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:Reflective_DLL_Loader_Aug17_2
Create hunting rule
Author:Florian Roth
Description:Detects Reflective DLL Loader - suspicious - Possible FP could be program crack
Reference:Internal Research
Rule name:WiltedTulip_ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:http://www.clearskysec.com/tulip

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/9043/

Comments