MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be3602e288cc89c2d376a2e09e20e8347fc20d3f682fffb843adc8b7c8168488. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CobaltStrike

Vendor detections: 17

Intelligence 17 IOCs YARA 43 File information Comments

SHA256 hash:	be3602e288cc89c2d376a2e09e20e8347fc20d3f682fffb843adc8b7c8168488
SHA3-384 hash:	685fe3ba63b57d82a40854ceb7daae66d79c9068c5e9a0a490c3e90fc1e35978398fc2f391c23bd42f2dd210274659f4
SHA1 hash:	720ced6cf863ca9809557a86e1e58d9f9956bd6e
MD5 hash:	edd3157a6f8a15089a7658fea49262b7
humanhash:	island-maryland-mobile-fifteen
File name:	beacon_certutil.exe
Download:	download sample
Signature	CobaltStrike Create hunting rule
File size:	284'672 bytes
First seen:	2023-06-29 20:34:57 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	dc25ee78e2ef4d36faa0badf1e7461c9 (118 x CobaltStrike, 6 x Cobalt Strike)
ssdeep	6144:ORjVjPLm6tOWe/OyDj4pCxBHfuYKamVPyd:OqFWUIpCSY9mod
Threatray	529 similar samples on MalwareBazaar
TLSH	T17054BF1F716273D5F783E2F7A5C10036909921AA0EF16E7EDC76A71F23012859E8EE49
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10523/12/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter	ULTRAFRAUD
Tags:	Cobalt Strike exe

Intelligence

File Origin

# of uploads :

# of downloads :

311

Origin country :

Vendor Threat Intelligence

Malware family:

cobaltstrike

ID:

File name:

beacon_certutil.exe

Verdict:

Malicious activity

Analysis date:

2023-06-29 20:35:54 UTC

Tags:

cobaltstrike

Link:

https://app.any.run/tasks/d2ae1841-6a48-4c80-8010-10de2690c248

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

CobaltStrikeBeacon

Link:

https://www.capesandbox.com/analysis/403882/

Detection(s):

Win.Countermeasure.LoaderWinGeneric-9804845-2

Win.Trojan.CobaltStrike-7899872-1

Result

Verdict:

Malware

Maliciousness:

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug cobalt cobaltstrike cozyduke rozena xpack

Link:

https://www.filescan.io/uploads/649deaf93b62a264297e829c/reports/84e776a0-5b96-438a-a982-c28894782e2f/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/be3602e288cc89c2d376a2e09e20e8347fc20d3f682fffb843adc8b7c8168488

Malware family:

Cobalt Strike

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f76f89bf-f7c5-4309-887e-1e028fa3bd05

Result

Threat name:

CobaltStrike, ReflectiveLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1263498

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Yara detected ReflectiveLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

cobaltstrike

Link:

https://mwdb.cert.pl/sample/be3602e288cc89c2d376a2e09e20e8347fc20d3f682fffb843adc8b7c8168488/

Threat name:

Win32.Backdoor.CobaltStrike

Status:

Malicious

First seen:

2022-06-21 00:48:00 UTC

File Type:

PE (Exe)

AV detection:

34 of 37 (91.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xy3afyuizse4fu3wulqj4ihigr74edj7nax77ocdvxelpsawqsea._file

Verdict:

malicious

Label(s):

cobaltstrike

CobaltStrike

0e30a27d44484b9baa56e7b6050581e3edc3bd1b426057c85824d0cac493a3f1

CobaltStrike

12b960dd90803aa2fb3af2468a0b117ca335e23ba5cf7cbb96f9cdcb97650871

CobaltStrike

5aedcd88018ef8f4a70a04ca259e7f2a087fde8ef98c7bbe21b1d511dd00a731

CobaltStrike

7d536b270b9bf18abaa1aac2515293cc30271ead88038fcefe7c04612b9a5c41

CobaltStrike

85bfd98e0bfdaa6be0b1d856bdbb23ddc32f4891a9cec6e08d7b3c47666f68c4

CobaltStrike

91bd127fe5f8e96e424dc509a6910edde262142eeadd6ba9f316cb5bde12221e

CobaltStrike

a2bcce439cb511eca635e14943b916e86a121c7062ac978437d2d080a54fff26

CobaltStrike

f4ca63aeb4e3246c5d923942497d650bc3920c9fbc78a330ecf9d7db67e0cb8f

CobaltStrike

+ 519 additional samples on MalwareBazaar

Result

Malware family:

cobaltstrike

Score:

10/10

Tags:

family:cobaltstrike botnet:0 backdoor trojan

Link:

https://tria.ge/reports/230629-zcz16aeh75/

Behaviour

Cobaltstrike

Malware Config

C2 Extraction:

http://192.168.253.77:80/visit.js

Unpacked files

SH256 hash:

0bdb82cef4c74840a1bccd5bec772bd1b446110fba08e5947c246343652f497d

MD5 hash:

7f2c91139de5e76ca2ed47d1d320cd83

SHA1 hash:

0675e27a6ccac05b236b57eaeae4fcf2b8050160

Detections:

cobaltstrike_xor_config

win_cobalt_strike_auto

Link:

https://www.unpac.me/results/dea8fef4-3fdb-4169-98ae-46dbfc0b0821/

SH256 hash:

be3602e288cc89c2d376a2e09e20e8347fc20d3f682fffb843adc8b7c8168488

MD5 hash:

edd3157a6f8a15089a7658fea49262b7

SHA1 hash:

720ced6cf863ca9809557a86e1e58d9f9956bd6e

Link:

https://www.unpac.me/results/dea8fef4-3fdb-4169-98ae-46dbfc0b0821/

Malware family:

CobaltStrike

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/be3602e288cc/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/be3602e288cc89c2d376a2e09e20e8347fc20d3f682fffb843adc8b7c8168488

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Beacon_K5om Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Meterpreter Beacon - file K5om.dll
Reference:	https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html

Rule name:	Beacon_K5om_RID2B14 Create hunting rule
Author:	Florian Roth
Description:	Detects Meterpreter Beacon - file K5om.dll
Reference:	https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html

Rule name:	Cobaltbaltstrike_Beacon_x86 Create hunting rule
Author:	Avast Threat Intel Team
Description:	Detects CobaltStrike payloads
Reference:	https://github.com/avast/ioc

Rule name:	Cobaltstrike1 Create hunting rule
Author:	Ahmet Payaslioglu \| Binalyze DFIR LAB
Description:	Cobalt Strike Detection

Rule name:	Cobaltstrike2 Create hunting rule
Author:	Ahmet Payaslioglu \| Binalyze DFIR LAB
Description:	Cobalt Strike Detection

Rule name:	Cobaltstrike3 Create hunting rule
Author:	Ahmet Payaslioglu \| Binalyze DFIR LAB
Description:	Cobalt Strike Detection

Rule name:	CobaltStrikeBeacon Create hunting rule
Author:	ditekshen, enzo & Elastic
Description:	Cobalt Strike Beacon Payload

Rule name:	CobaltStrike_C2_Encoded_XOR_Config_Indicator Create hunting rule
Author:	yara@s3c.za.net
Description:	Detects CobaltStrike C2 encoded profile configuration

Rule name:	CobaltStrike_ReflectiveLoader_RID3297 Create hunting rule
Author:	Florian Roth
Description:	Detects reflective loader (Cobalt Strike)
Reference:	http://www.clearskysec.com/tulip

Rule name:	CobaltStrike_Resources_Artifact32_v3_14_to_v4_x Create hunting rule
Author:	gssincla@google.com
Description:	Cobalt Strike's resources/artifact32{.dll,.exe,big.exe,big.dll,bigsvc.exe} signature for versions 3.14 to 4.x and resources/artifact32svc.exe for 3.14 to 4.x and resources/artifact32uac.dll for v3.14 and v4.0
Reference:	https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse

Rule name:	CobaltStrike_Sleeve_Beacon_Dll_v4_1_and_v4_2 Create hunting rule
Author:	gssincla@google.com
Description:	Cobalt Strike's sleeve/beacon.dll Versions 4.1 and 4.2
Reference:	https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse

Rule name:	CobaltStrike_Unmodifed_Beacon Create hunting rule
Author:	yara@s3c.za.net
Description:	Detects unmodified CobaltStrike beacon DLL

Rule name:	CobaltStrike__Resources_Artifact32_v3_14_to_v4_x Create hunting rule
Author:	gssincla@google.com

Rule name:	CobaltStrike__Sleeve_Beacon_Dll_v4_1_and_v4_2 Create hunting rule
Author:	gssincla@google.com

Rule name:	crime_win32_csbeacon_1 Create hunting rule
Author:	@VK_Intel
Description:	Detects Cobalt Strike loader
Reference:	https://twitter.com/VK_Intel/status/1239632822358474753

Rule name:	CS_beacon Create hunting rule
Author:	Etienne Maynier tek@randhome.io

Rule name:	HKTL_CobaltStrike_Beacon_4_2_Decrypt Create hunting rule
Author:	Elastic
Description:	Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2
Reference:	https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures

Rule name:	HKTL_CobaltStrike_Beacon_Strings Create hunting rule
Author:	Elastic
Description:	Identifies strings used in Cobalt Strike Beacon DLL
Reference:	https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures

Rule name:	HKTL_Imphashes_Aug22_1 Create hunting rule
Author:	Florian Roth
Description:	Detects different hacktools based on their imphash
Reference:	Internal Research

Rule name:	HKTL_Meterpreter_inMemory Create hunting rule
Author:	netbiosX, Florian Roth
Description:	Detects Meterpreter in-memory
Reference:	https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/

Rule name:	HKTL_Win_CobaltStrike Create hunting rule
Author:	threatintel@volexity.com
Description:	The CobaltStrike malware family.
Reference:	https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/

Rule name:	INDICATOR_SUSPICIOUS_ReflectiveLoader Create hunting rule
Author:	ditekSHen
Description:	detects Reflective DLL injection artifacts

Rule name:	Leviathan_CobaltStrike_Sample_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Cobalt Strike sample from Leviathan report
Reference:	https://goo.gl/MZ7dRg

Rule name:	Leviathan_CobaltStrike_Sample_1_RID3324 Create hunting rule
Author:	Florian Roth
Description:	Detects Cobalt Strike sample from Leviathan report
Reference:	https://goo.gl/MZ7dRg

Rule name:	malware_CobaltStrike_v3v4 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect CobaltStrike Beacon in memory
Reference:	https://blogs.jpcert.or.jp/en/2018/08/volatility-plugin-for-detecting-cobalt-strike-beacon.html

Rule name:	Malware_QA_vqgk Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	VT Research QA uploaded malware - file vqgk.dll
Reference:	VT Research QA

Rule name:	MALWARE_Win_CobaltStrike Create hunting rule
Author:	ditekSHen
Description:	CobaltStrike payload

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	PowerShell_Susp_Parameter_Combo_RID336F Create hunting rule
Author:	Florian Roth
Description:	Detects PowerShell invocation with suspicious parameters
Reference:	https://goo.gl/uAic1X

Rule name:	ReflectiveLoader Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:	Internal Research

Rule name:	SUSP_XORed_Mozilla Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	troj_win_cobaltstrike_memoryinject Create hunting rule
Author:	Jeff White (karttoon@gmail.com) @noottrak
Description:	Detects Cobalt Strike payload typically loaded into memory via PowerShell.

Rule name:	WiltedTulip_ReflectiveLoader Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:	http://www.clearskysec.com/tulip

Rule name:	Windows_Trojan_CobaltStrike_1787eef5 Create hunting rule
Author:	Elastic Security
Description:	CS shellcode variants

Rule name:	Windows_Trojan_CobaltStrike_29374056 Create hunting rule
Description:	Identifies Cobalt Strike MZ Reflective Loader.

Rule name:	Windows_Trojan_CobaltStrike_b54b94ac Create hunting rule
Description:	Rule for beacon sleep obfuscation routine

Rule name:	Windows_Trojan_CobaltStrike_ee756db7 Create hunting rule
Description:	Attempts to detect Cobalt Strike based on strings found in BEACON

Rule name:	Windows_Trojan_Metasploit_7bc0f998 Create hunting rule
Description:	Identifies the API address lookup function leverage by metasploit shellcode

Rule name:	Windows_Trojan_Metasploit_c9773203 Create hunting rule
Description:	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:	https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm

Rule name:	win_cobalt_strike_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.cobalt_strike.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/403882/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample