MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca847340992ff249d8b4425a942d96be6a9380a381123c693475030fd598e5d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca847340992ff249d8b4425a942d96be6a9380a381123c693475030fd598e5d5
SHA3-384 hash: 601e38ca6995986679fd00044a2d55e0bd11a30d4403025418bcf214cd9a966ff52adf51592c1a89a0a00f7e7aeae58d
SHA1 hash: 04180cc15b9cb1d7d87ebbfc76b5c53370a41432
MD5 hash: b586da6fa7eb140fa56e16eafafc5d63
humanhash: kentucky-uncle-burger-december
File name:cTKZ
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:213'577 bytes
First seen:2022-06-01 09:00:34 UTC
Last seen:Never
File type:unknown
MIME type:application/octet-stream
ssdeep 6144:7s64cZ5VHyVoC2GJdytxJQ4zA2nBWiBgObahQ:gdcLcV20dyt44nmle
TLSH T17C24DF320B33937260E328DD5F24AF18139C787B4A96B98FD156D5B6DF102DA236643C
Reporter 1ZRR4H
Tags:CobaltStrike follina


Avatar
1ZRR4H
Beacon from https://172.105.99.246/cTKZ

Intelligence

File Origin
# of uploads :
1
# of downloads :
355
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.Meterpreter.152.31480.23659.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ca847340992ff249d8b4425a942d96be6a9380a381123c693475030fd598e5d5/
Threat name:
Win32.Trojan.CobaltStrike
Create hunting rule
Status:
Suspicious
First seen:
2022-06-01 09:01:08 UTC
File Type:
Binary
AV detection:
7 of 41 (17.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zkchgqezf7zetwfuijnjilmwxzvjhafdqejdy2juoubq7vmy4xkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/ca847340992ff249d8b4425a942d96be6a9380a381123c693475030fd598e5d5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobaltbaltstrike_Beacon_XORed_x86
Create hunting rule
Author:Avast Threat Intel Team
Description:Detects CobaltStrike payloads
Reference:https://github.com/avast/ioc
Rule name:malware_CobaltStrike_beacon
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:CobaltStrike encoding code

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/malwrhunterteam/status/1531725207836274691

Comments