MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7f90e07d571707c42557c6169817834d791c438e964878729c941733b3c8ca6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 14


Intelligence 14 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c7f90e07d571707c42557c6169817834d791c438e964878729c941733b3c8ca6
SHA3-384 hash: 1aacdd843fd08fecd2dc7455951ac1152943be4c7086347e776a1f8766448b58e076a37362876710e6b330a6bdc68e81
SHA1 hash: f5221afe28c2e35ed6973d81a131724173af4d2e
MD5 hash: 469d3ff33967d51557af1785fef1d701
humanhash: november-pennsylvania-earth-zulu
File name:cs.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:228'864 bytes
First seen:2022-03-11 17:14:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 829da329ce140d873b4a8bde2cbfaa7e (259 x CobaltStrike)
ssdeep 6144:R443XR4S38C4BeBxi66thkbAzLks1YarGR8ej4rC5B/I:NMZMBIz+YLks1YarGR8Pu/I
Threatray 122 similar samples on MalwareBazaar
TLSH T15E24BEB1B41EBDA4F08B46B60D4FF0A2AD50EED7A49EA61B70F4A50597CA573340F603
Reporter drb_ra
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
163
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cobaltstrike_shellcode.exe
Verdict:
No threats detected
Analysis date:
2022-03-11 17:14:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/40358b46-76c0-4f2e-82ad-d4115ecac384

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/249598/
Detection(s):
Win.Exploit.D3b71c-9863766-0
Create hunting rule

SecuriteInfo.com.Crypt5.BLLV.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Creating a file in the system32 directory
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/8887/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug obfuscated
Link:
https://www.filescan.io/uploads/622b83a6b94fb38cb45e3759/reports/b19bf016-6b9d-4a55-9272-38831b84038c/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Cobalt Strike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dfbd4a9d-3cad-4860-846a-f2eacce473eb
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/955103
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
cobaltstrike
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c7f90e07d571707c42557c6169817834d791c438e964878729c941733b3c8ca6/
Threat name:
Win32.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2022-03-11 17:15:12 UTC
File Type:
PE (Exe)
AV detection:
25 of 27 (92.59%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y74q4b6vofyhyqsvprqwtalygtlzdrby5fsipbzjzfaxgoz4rsta._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
0b4ebf0528180d7b88c4ccbd9a5364a46383edcccf0364045ee6d9d0555b63d1
CobaltStrike
3503cc8b2b33ef3f14724bec7e7c8860786f9b62174e1cd87b4ae679ecf8d401
CobaltStrike
72e8bc12f384636fc86ced4c1d53f584e9ad4b6acd29748a59845e9cb631ff60
CobaltStrike
8c29f1be7dafc7b0b64581e8b28857e988acf33874ce6af6c029c674be60025e
CobaltStrike
aa71d1f8581296304caf7f0a046273e1db94101509319733dc973500dd03fdec
CobaltStrike
b4f6c11f8821d7f8463f29cb85ac120c21f4f55a69b5bc85fbe0bf691de472a8
CobaltStrike
+ 112 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:505417884
Link:
https://tria.ge/reports/220311-vsl21sdebm/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Malware Config
C2 Extraction:
http://www.menshealth.co.uk:443/safebrowsing/fp/XqhKLOYnlfXJxJXouv2hRVGJBxDepikZXmYpU950pH4Z
Unpacked files
SH256 hash:
c7f90e07d571707c42557c6169817834d791c438e964878729c941733b3c8ca6
MD5 hash:
469d3ff33967d51557af1785fef1d701
SHA1 hash:
f5221afe28c2e35ed6973d81a131724173af4d2e
Link:
https://www.unpac.me/results/6aa135aa-9b53-44a5-b2dd-0d0ecf2c9885/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c7f90e07d571707c42557c6169817834d791c438e964878729c941733b3c8ca6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobaltbaltstrike_strike_Payload_XORed
Create hunting rule
Author:Avast Threat Intel Team
Description:Detects CobaltStrike payloads
Reference:https://github.com/avast/ioc
Rule name:CobaltStrikeBeacon
Create hunting rule
Author:ditekshen, enzo & Elastic
Description:Cobalt Strike Beacon Payload
Rule name:CobaltStrike_C2_Encoded_XOR_Config_Indicator
Create hunting rule
Author:yara@s3c.za.net
Description:Detects CobaltStrike C2 encoded profile configuration
Rule name:HKTL_CobaltStrike_Beacon_Strings
Create hunting rule
Author:Elastic
Description:Identifies strings used in Cobalt Strike Beacon DLL
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5
Create hunting rule
Author:Florian Roth
Description:Detects strings found in CobaltStrike shellcode
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Rule name:HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5_RID361D
Create hunting rule
Author:Florian Roth
Description:Detects strings found in malware samples in APT report in DarkHydrus
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Rule name:malware_CobaltStrike_v3v4
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect CobaltStrike Beacon in memory
Reference:https://blogs.jpcert.or.jp/en/2018/08/volatility-plugin-for-detecting-cobalt-strike-beacon.html
Rule name:SUSP_XORed_Mozilla
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:XOREngine_Misc_XOR_Func
Create hunting rule
Author:smiller cc @florian @wesley idea on implementation with yara's built in XOR function
Description:Use with care, https://twitter.com/cyb3rops/status/1237042104406355968

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/249598/

Comments