MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bfe1babe6615da068908c02fd831232069147f9c7a1b6d9a219ec2da370332ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bfe1babe6615da068908c02fd831232069147f9c7a1b6d9a219ec2da370332ef
SHA3-384 hash: d9fd3707a8606ebf6f9ff5569e3661aa4463a096ac15b151a779785ac2580200953332c890091ad6480f62056f11f153
SHA1 hash: e908281917d5c3303c519edb01d737fc62e2b2b5
MD5 hash: d868182d5ac44460ea3b62e417205371
humanhash: william-mars-arizona-foxtrot
File name:NId.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:74'240 bytes
First seen:2022-06-19 08:30:03 UTC
Last seen:2022-06-19 09:46:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 8424b23b4a5498e64b3447af3dd4c728 (1 x CobaltStrike)
ssdeep 768:YI8eLD5zheMVVJ3uNWm0oIMda7JjxlEvIctwks0n1ThWZButyj1zV37naFDHRhpB:YRQoWUdA9w1TYZBut6V37pUIiiWBx
Threatray 676 similar samples on MalwareBazaar
TLSH T15F734BC6FAC740F1E51B61F024DBFB7FC931BB238928DEB5EBA85644E623B425106119
TrID 33.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
21.3% (.EXE) Win64 Executable (generic) (10523/12/4)
13.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter obfusor
Tags:CobaltStrike exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
660
Origin country :
n/a
Vendor Threat Intelligence
Detection:
CobaltStrike
Create hunting rule
Link:
https://www.capesandbox.com/analysis/281218/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.90079.7233.32077.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/21896/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/62aede94473553ed31a11589/reports/6ca8b50b-fcea-4a5b-ab5b-35f23af59375/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Cobalt Strike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/40cdd968-5d56-48e6-8a8e-911d848577b9
Result
Threat name:
CobaltStrike, Metasploit, ReflectiveLoad
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1015810
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Uses known network protocols on non-standard ports
Yara detected CobaltStrike
Yara detected CobaltStrike Stager
Yara detected Metasploit Payload
Yara detected ReflectiveLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bfe1babe6615da068908c02fd831232069147f9c7a1b6d9a219ec2da370332ef/
Threat name:
Win32.Backdoor.CobaltStrikeBeacon
Create hunting rule
Status:
Malicious
First seen:
2022-06-17 09:59:58 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
11 of 26 (42.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x7q3vptgcxnanciiyax5qmjdeburi744pinw3grbt3bnunydglxq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
50cea054f1bfeb13485a6a3fb68319577f577db8a9442552fbc55f3f111c5c66
CobaltStrike
5e64039561c03a0af6a96ae348d8b57515fdc9e234ad8809e5cd311a69377bae
CobaltStrike
65c9806619e03488c8668a9e06896d2b27dff8fd3c07aa9d4e5383d094eab9ab
CobaltStrike
9285d2519f669384a0946fb5d4e20494dcbdc970a417da7529ba3534f597f39b
CobaltStrike
d51535fbb853fd16a36644696134e613fe39eb31c7d30d719926e794446bb715
CobaltStrike
e8710133491bdf0b0d1a2e3d9a2dbbf0d58e0dbb0e0f7c65acef4f788128e1e4
CobaltStrike
+ 666 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike backdoor suricata trojan
Link:
https://tria.ge/reports/220619-kd568sgcc7/
Behaviour
Cobaltstrike
suricata: ET MALWARE Cobalt Strike Beacon Observed
Unpacked files
SH256 hash:
bfe1babe6615da068908c02fd831232069147f9c7a1b6d9a219ec2da370332ef
MD5 hash:
d868182d5ac44460ea3b62e417205371
SHA1 hash:
e908281917d5c3303c519edb01d737fc62e2b2b5
Link:
https://www.unpac.me/results/c7708126-3d10-4285-9c08-774c4f64d257/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/bfe1babe6615da068908c02fd831232069147f9c7a1b6d9a219ec2da370332ef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/281218/

Comments