MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf89c26372de6d0c5dac52f0b86717ff2c7854177f36b1e9a9fa6f72a96a4f42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 6


Intelligence 6 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf89c26372de6d0c5dac52f0b86717ff2c7854177f36b1e9a9fa6f72a96a4f42
SHA3-384 hash: 18fd0b09318070a8523dbcfb7220b1e3377dfb61ab6cd044ea4004afcc1b97be9c962e59010edab4d3814095f4ef56fc
SHA1 hash: 5558bdc0ebec2aa79aba7c25f9ff604aa90a5553
MD5 hash: 84947913e13d48d924decb85f790c574
humanhash: harry-indigo-apart-magnesium
File name:bf89c26372de6d0c5dac52f0b86717ff2c7854177f36b1e9a9fa6f72a96a4f42
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:208'896 bytes
First seen:2020-11-10 06:56:41 UTC
Last seen:2024-07-24 21:04:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b450a8226d3ed9f582c2242845b7b787 (57 x CobaltStrike)
ssdeep 3072:kwqvDkSOqI1Yl59Ebxd0KdPOzqXFRBaK/6hg66xc5xh58jojUGhjQUm5Hs:mOqIKP9Eb1H/JDcDjUSjL
Threatray 136 similar samples on MalwareBazaar
TLSH 1D149E513580F037D04B0039A20B9B624FF9FD756BB59887FF984E999E717A2DA29303
Reporter seifreed
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
2
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Exploit.Cobaltstrike-9774514-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bf89c26372de6d0c5dac52f0b86717ff2c7854177f36b1e9a9fa6f72a96a4f42/
Threat name:
Win32.PUA.CobaltStrikeBeacon
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 06:59:26 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x6e4ey3s3zwqyxnmklylqzyx74whqvaxp43ld2nj7jxxfklkj5ba._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
19ef6a3ce60b67cc2f308bc56d3529d2d5ae3454f4e727d746bd8fb1a8ae0fe4
CobaltStrike
46bbcc6fde17df7a4ae20797371415a8e3a51346cd5ceee2487e7add0afc8046
CobaltStrike
623ec9739a929c33ce48d82a53cecc9c2dedd8f91be9c222e7f5301b53743887
CobaltStrike
a911e0a1c750c0abbe7bc193b8e002aa3ceeaf466f4a3b05d6a74e3c36f6fc27
CobaltStrike
ac7c3889306bdb5375faa33034f0dea452521c5f62994be5e94b6be5a4229b9e
CobaltStrike
ae63cd0a53cbefb25fa2a48194404ba5facd7b8029a9fe9a6ccd36a11577c9e9
CobaltStrike
bb844851de788e926db25a6fcb2e334aa9deb3ef8b76a0ef71b6fc0c6acafee3
CobaltStrike
d0d5f80d6805234e6dacc2ab884029ba2b1600efbd58a2cce87ac3182b305ca1
CobaltStrike
d8e7ac1f9ae87d31797a3972452808a0421669428a41978316557f6435f5df67
CobaltStrike
fcddf985b31c9b3c7cda89ff338500cd0863dbcd15213d86bd524ac5063e2d31
CobaltStrike
+ 126 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike backdoor trojan
Link:
https://tria.ge/reports/201110-p6p751m4bn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Cobaltstrike
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CobaltStrikeBeacon
Create hunting rule
Author:enzo
Description:Cobalt Strike Beacon Payload
Rule name:CobaltStrike_Sleep_Decoder_Indicator
Create hunting rule
Author:yara@s3c.za.net
Description:Detects CobaltStrike sleep_mask decoder
Rule name:CobaltStrike_Unmodifed_Beacon
Create hunting rule
Author:yara@s3c.za.net
Description:Detects unmodified CobaltStrike beacon DLL
Rule name:crime_win32_csbeacon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Cobalt Strike loader
Reference:https://twitter.com/VK_Intel/status/1239632822358474753
Rule name:HKTL_Meterpreter_inMemory
Create hunting rule
Author:netbiosX, Florian Roth
Description:Detects Meterpreter in-memory
Reference:https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Rule name:ReflectiveLoader
Create hunting rule
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:SUSP_XORed_Mozilla
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:WiltedTulip_ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:http://www.clearskysec.com/tulip

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments