MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0c88b0ca2a78ef90470498fa686ad63e3473a4fc1337b2850461ecc07bd5b34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d0c88b0ca2a78ef90470498fa686ad63e3473a4fc1337b2850461ecc07bd5b34
SHA3-384 hash: 7855f3a538cf77184fba4941f8b889027a528160224dc2f44e3ca2b18dafb1b9002b5bca0ce53b6ff955d5504b8fd62c
SHA1 hash: 2d6d3236c0db3a94fa3ee24b13235bdadca60d1b
MD5 hash: 2f4cd697a40de0d752287e03f3175a17
humanhash: victor-helium-kentucky-bakerloo
File name:2f4cd697a40de0d752287e03f3175a17.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:72'196 bytes
First seen:2020-11-05 06:26:46 UTC
Last seen:2020-11-05 08:10:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c7d4cffcfde489cf0e0b819bfeb844f3 (1 x CobaltStrike)
ssdeep 768:0twMI0V0eritDFnMjjk7yZ8oFYwVy2n4U3A2rDxIVyi2zNKZ9c8WWAsWjcdO+2D3:0I0edMjjkdwY24F2PnKc8qsWjcdOHKBu
Threatray 125 similar samples on MalwareBazaar
TLSH 3B636B0376D188B1E4B70BB509F4CA515B6FBD225E748D6B3788118E4A312E09F36FA3
Reporter abuse_ch
Tags:CobaltStrike exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/83053/
Detection(s):
SecuriteInfo.com.DeepScan.Generic.Exploit.Shellcode.1.F4C44257.696.12393.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/520946
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d0c88b0ca2a78ef90470498fa686ad63e3473a4fc1337b2850461ecc07bd5b34/
Threat name:
Win32.Trojan.Cometsys
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 20:15:15 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2deiwdfcu6hpsbdqjgh2nbvnmpruoospyezxwkcqiypmyb55lm2a._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
2d797a098d2c0e164f5bfe29e3ae282f873709270f05950a3dc76d65f1acf47c
CobaltStrike
53c9abf3e3d86b1d9d633aff273a70f11e83858d3fdb362108395f170bcdebc4
CobaltStrike
5cd1e21eef3c4ed694dc429b88b403995244060feb4fdea12473aff4d782e1f5
CobaltStrike
843ecb8f65383d379efac41850e2962630597fbb9d327215268c480e896fa16a
CobaltStrike
8f7b9a377a14260d8bdcc6e18e749013a0c2c09a60d46fa026d77f6d92b7b801
CobaltStrike
9b27a5018742f9fd6d6c1f94e56215b64eaf0b263e43b82feec02ceeab208398
CobaltStrike
a9ca1d6a981ccc8d8b144f337c259891a67eb6b85ee41b03699baacf4aae9a78
CobaltStrike
ad42170cf53ef7e0ea91196fedd5f8ae7665e207f9de002c63562f4b1db57717
CobaltStrike
d1a71b6a8691f72eb133570b9e90e8de061a652a35e3b4039d0875bbc0f76f1c
CobaltStrike
e4ca37b939f9ca60aab3b68d49169ee93e46548b76dfb31eeb43d4161fd3dc1a
CobaltStrike
+ 115 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike backdoor trojan
Link:
https://tria.ge/reports/201105-6n3h5br6me/
Behaviour
Modifies system certificate store
Cobaltstrike
Malware Config
C2 Extraction:
http://beltpost.com:443/us/ky/louisville/312-s-fourth-st.html
http://sslcar.com:443/us/ky/louisville/312-s-fourth-st.html
http://livenx.com:443/us/ky/louisville/312-s-fourth-st.html
http://stylesam.com:443/us/ky/louisville/312-s-fourth-st.html
http://epicnut.com:443/us/ky/louisville/312-s-fourth-st.html
Unpacked files
SH256 hash:
d0c88b0ca2a78ef90470498fa686ad63e3473a4fc1337b2850461ecc07bd5b34
MD5 hash:
2f4cd697a40de0d752287e03f3175a17
SHA1 hash:
2d6d3236c0db3a94fa3ee24b13235bdadca60d1b
Link:
https://www.unpac.me/results/ec37fdbe-1460-4435-bdb2-1e7aff9c7564/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/83053/

Comments