MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb8742e6f31e36de917770705487add71a2e536580df52185dee4863a888431e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 8


Intelligence 8 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb8742e6f31e36de917770705487add71a2e536580df52185dee4863a888431e
SHA3-384 hash: e1c5b5a4a15762469e4939b6092b188f747e9c8bcffb49d25026b5d250a89e7d07e86febc95cd5bdd76a94358ab1ab44
SHA1 hash: fb3e9639dbcc4c89f946ed41acf0a9b16b184e1f
MD5 hash: 6e5a6c3d1d66ba6b8a66e023edb10ae1
humanhash: victor-freddie-blossom-uncle
File name:6e5a6c3d1d66ba6b8a66e023edb10ae1.dll
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:354'304 bytes
First seen:2021-06-20 07:32:33 UTC
Last seen:2021-06-20 08:48:51 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash a4295032178dc2932a89d12d68456a8c (2 x CobaltStrike)
ssdeep 6144:isADrhYOTEA4mdmYLZ7EDDM4+IrXunfO07WT+tYixu8H+m14M9MfQ:GHeEO0aeYF5/M9MfQ
Threatray 235 similar samples on MalwareBazaar
TLSH 2A743936BA95C0B5D0DD85F0691DAA59842C6E3927708CEBE3C07D2F6DF60805BA1F36
Reporter abuse_ch
Tags:CobaltStrike dll

Intelligence

File Origin
# of uploads :
2
# of downloads :
585
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/167148/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37081231.24018.17124.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b0d8fb46-8472-4bd5-881b-a23922771e58
Result
Threat name:
CobaltStrike Metasploit
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/804866
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: CobaltStrike Load by Rundll32
System process connects to network (likely due to code injection or exploit)
Yara detected CobaltStrike
Yara detected Metasploit Payload
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb8742e6f31e36de917770705487add71a2e536580df52185dee4863a888431e/
Threat name:
Win32.Backdoor.CobaltStrikeLoader
Create hunting rule
Status:
Malicious
First seen:
2021-06-11 21:11:45 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zodufzxtdy3n5elxobyfjb5n24nc4u3fqdpvegc55zeghkeiimpa._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
0e30a27d44484b9baa56e7b6050581e3edc3bd1b426057c85824d0cac493a3f1
CobaltStrike
1c330c3c27432b209b502cbb22ed35eaf761366511a95539b3624117d7f6c40c
CobaltStrike
24197e271f0a1ae404e7e136a4d79d4e90537c18b4c598bef0801e32ca63b8c0
CobaltStrike
35b6d770bb5d9cdf686f07226c67de969c21648af598ee58036383a606802327
CobaltStrike
5724f81b8cc1a9a3330cb22020e393c854471f605b422b99a2fd5dda3d32cf80
CobaltStrike
65d5e3d6f233a393e6c4d11fa947f733f3109e005cc1f957abe2ab8d78dc6002
CobaltStrike
6afab1df3de00b1200198e692eae6dc36373c310cf4102ecacc5c6e8ff89a7e8
CobaltStrike
b568a4ca18fce49b465d0db8697640d556f579932db0315398a810140c66f0db
CobaltStrike
be106bc807b68d8d2bea83f7fbd526675f127b2f234d6c31e2932bb5a5d1aa34
CobaltStrike
f4ca63aeb4e3246c5d923942497d650bc3920c9fbc78a330ecf9d7db67e0cb8f
CobaltStrike
+ 225 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210620-slljtxh9ln/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
cb8742e6f31e36de917770705487add71a2e536580df52185dee4863a888431e
MD5 hash:
6e5a6c3d1d66ba6b8a66e023edb10ae1
SHA1 hash:
fb3e9639dbcc4c89f946ed41acf0a9b16b184e1f
Link:
https://www.unpac.me/results/6e394a82-ddf0-4c41-b893-385deb1221b3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cb8742e6f31e36de917770705487add71a2e536580df52185dee4863a888431e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CobaltStrikeBeacon
Create hunting rule
Author:enzo
Description:Cobalt Strike Beacon Payload
Rule name:HKTL_CobaltStrike_Beacon_Strings
Create hunting rule
Author:Elastic
Description:Identifies strings used in Cobalt Strike Beacon DLL
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_Win_CobaltStrike
Create hunting rule
Author:threatintel@volexity.com
Description:The CobaltStrike malware family.
Reference:https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
Rule name:SUSP_XORed_Mozilla
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:Trojan_Raw_Generic_4
Create hunting rule
Author:FireEye
Reference:https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/167148/

Comments