MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1d0c9d1ee7b800d491c9fb3fc94b93e5c59d903a4debb092846c46481077ae0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d1d0c9d1ee7b800d491c9fb3fc94b93e5c59d903a4debb092846c46481077ae0
SHA3-384 hash: b98a1689e53b4634d90509449bfccf4f2e28c948ea1de7b866ced9d0845bff3f8eb172e33d0875984540e6b96ad85473
SHA1 hash: b96fed2621b5eb8d44ac18540d7ddadee98dcff4
MD5 hash: 79c85e72fc11702fa14a481d6661d0f0
humanhash: alabama-music-blossom-spring
File name:8dll.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:1'380'824 bytes
First seen:2021-08-03 08:27:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5f2cee0a10c197d5b837bcb90f46d21e (1 x CobaltStrike)
ssdeep 24576:UTBtdR63krMYEFz8rlLZY+TzNqyQTq6y0xuWxHxO3mP+Hbvp:UttdR/gYL1Z9Nqy2y0xpHzPm
Threatray 1'038 similar samples on MalwareBazaar
TLSH T1AA5537A564C4AFD7DC7AF2FE8EC5E01AFD521000C1EA884945D4485606F53F3AABEB39
Reporter JAMESWT_WT
Tags:CobaltStrike exe jinoldmaplszs.site signed StackUp ApS

Code Signing Certificate

Organisation:StackUp ApS
Issuer:DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:sha256WithRSAEncryption
Valid from:2021-07-16T00:00:00Z
Valid to:2022-07-19T23:59:59Z
Serial number: 0400c7614f86d75fe4ee3f6192b6feda
Intelligence: 12 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: 64cd94f7ed9b7ba8f7d58445c0b9d9823d37782cc3500d359b86c4a3b091d5b8
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
501
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8dll.exe
Verdict:
No threats detected
Analysis date:
2021-08-03 08:29:43 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b282d75a-f60c-47fb-b5a3-202b522d4b53

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/175970/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/22356708-655b-4c33-aeb5-ccce8680ca4c
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/825967
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Tries to detect virtualization through RDTSC time measurements
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
cobaltstrike
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d1d0c9d1ee7b800d491c9fb3fc94b93e5c59d903a4debb092846c46481077ae0/
Threat name:
Win64.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2021-08-03 08:28:07 UTC
File Type:
PE+ (Exe)
AV detection:
3 of 46 (6.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2himtupopoaa2si4t6z7zffzhzoftwidutplwcjii3cgjaihplqa._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
1b11ae98b85bb0645abe36adcd852e6e84b51c6b5c811729f3c19f14f32d4e4f
CobaltStrike
2bfe11c06ffe157399432080f6de6190e1062c99b4a55ec31974b5a37ee8dd3c
CobaltStrike
42104ac31fe7ae7328c209007ea71dc3effb183c736a9bddcf86f690fe96df9a
CobaltStrike
954944ef6cdd1474ed35f27b790a7914156672cc7a1afbcc3214ccc1855ff12e
CobaltStrike
971c693bc67cf7b4b9655282b815bc1ba10ee937f1736ba1ef5fdb7aea392f6c
CobaltStrike
9ca6449c0586a77c55586bcc7adfaef2c3cc53da4713c5ed57fced15a3054545
CobaltStrike
bb4efe96748fcc28b827fc297d060c3ab32053cfb8ea506f8c97000debd22121
CobaltStrike
e8d4bf2dc68074adf01dc003d51de3842994ae07fa88c370e8d29f1c27d9c407
CobaltStrike
+ 1'028 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:0 backdoor suricata trojan
Link:
https://tria.ge/reports/210803-a4vrqdyzw2/
Behaviour
Modifies system certificate store
Cobaltstrike
suricata: ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response
Malware Config
C2 Extraction:
http://smallgop.com:443/jquery-3.3.1.min.js
Unpacked files
SH256 hash:
d1d0c9d1ee7b800d491c9fb3fc94b93e5c59d903a4debb092846c46481077ae0
MD5 hash:
79c85e72fc11702fa14a481d6661d0f0
SHA1 hash:
b96fed2621b5eb8d44ac18540d7ddadee98dcff4
Link:
https://www.unpac.me/results/4d38001b-6970-4d7a-9fde-b09e7f7a306d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d1d0c9d1ee7b800d491c9fb3fc94b93e5c59d903a4debb092846c46481077ae0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CobaltStrike

Executable exe d1d0c9d1ee7b800d491c9fb3fc94b93e5c59d903a4debb092846c46481077ae0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1501918/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/175970/

Comments