MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bdc7619588ad4a12c7711965b8c80991621646bb86d1ef8a8c19050c9082d45c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 5


Intelligence 5 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bdc7619588ad4a12c7711965b8c80991621646bb86d1ef8a8c19050c9082d45c
SHA3-384 hash: e0329bc291beed5f56756a0191c315aa28788892afcaac55c627579e1ca5adb2dd9f861adce58d9511d0b29a1e79b7c2
SHA1 hash: 8c15025e7225e0ae337b07ea882989c1368e368d
MD5 hash: 6301d3eb35123e34aa049a73c0e256be
humanhash: whiskey-carpet-robin-apart
File name:bdc7619588ad4a12c7711965b8c80991621646bb86d1ef8a8c19050c9082d45c.bin
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:291'480 bytes
First seen:2021-05-31 11:18:19 UTC
Last seen:2021-05-31 12:16:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 6b5ee317848f41a398bf927a4ec58e5c (1 x CobaltStrike)
ssdeep 6144:l1KGOax3iNPdD8kJdT368PS8onpiFyy6S:l1rOaJ21bdG8PS8onpisy6
TLSH D454AF79834288F4C668FA7C5F8E5A18145EDEBA5119632ECBAEC931AF001FFD54DC81
Reporter JAMESWT_WT
Tags:1.A Connect GmbH CobaltStrike exe

Code Signing Certificate

Organisation:1.A Connect GmbH
Issuer:COMODO RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2018-08-13T00:00:00Z
Valid to:2022-08-13T23:59:59Z
Serial number: a7e4ded4bf949d15aa4201843f1ab64d
Intelligence: 30 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: d519622e7d1eab2c240860d38779704319f1349cc57ab8c3d51d9f56145b582f
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
175
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bdc7619588ad4a12c7711965b8c80991621646bb86d1ef8a8c19050c9082d45c.bin
Verdict:
No threats detected
Analysis date:
2021-05-31 11:40:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7839a438-ca69-4f3a-bfa0-6fdaa5d25886

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/163442/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.46054481.2459.23002.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/794651
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bdc7619588ad4a12c7711965b8c80991621646bb86d1ef8a8c19050c9082d45c/
Threat name:
Win64.Trojan.Mamson
Create hunting rule
Status:
Malicious
First seen:
2021-04-09 10:11:03 UTC
File Type:
PE+ (Exe)
AV detection:
27 of 45 (60.00%)
Threat level:
  5/5
Verdict:
unknown
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210531-w9wmfmslre/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dropper
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/bdc7619588ad4a12c7711965b8c80991621646bb86d1ef8a8c19050c9082d45c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CobaltStrikeBeacon
Create hunting rule
Author:enzo
Description:Cobalt Strike Beacon Payload
Rule name:CS_beacon
Create hunting rule
Author:Etienne Maynier tek@randhome.io
Rule name:HKTL_CobaltStrike_Beacon_Strings
Create hunting rule
Author:Elastic
Description:Identifies strings used in Cobalt Strike Beacon DLL
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_Win_CobaltStrike
Create hunting rule
Author:threatintel@volexity.com
Description:The CobaltStrike malware family.
Reference:https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
Rule name:SUSP_XORed_Mozilla
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:Trojan_Raw_Generic_4
Create hunting rule
Author:FireEye
Reference:https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/163442/

Comments