MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9ef56a29627c7dddd5b7422d97c8ce56e6ae722e34d8d034b1fdac649357913. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CobaltStrike

Vendor detections: 11

Intelligence 11 IOCs YARA 9 File information Comments

SHA256 hash:	d9ef56a29627c7dddd5b7422d97c8ce56e6ae722e34d8d034b1fdac649357913
SHA3-384 hash:	b16303320d69c9dda50791c4aaeced8188e55ccae83ab8d43c84e41b7c28bde8284b0cd0ee37600a0835e56746be7dd7
SHA1 hash:	d6811c747aa1cd9e28c84ef356e5ff2b130d8a72
MD5 hash:	5b4cec97066d00352d706b03893004bb
humanhash:	jersey-burger-triple-hot
File name:	DE591848.exe
Download:	download sample
Signature	CobaltStrike Create hunting rule
File size:	5'714'432 bytes
First seen:	2023-07-17 08:45:50 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4e53160a12270531910b87162a608761 (2 x CobaltStrike)
ssdeep	49152:qEMn13tMbrb/TRvO90dL3BmAFd4A64nsfJ8JVHRrkPrp32NuHG5sd4xjR1TrzDaW:b+3Qja1BGqyr3aWyTixocxJ1
Threatray	3 similar samples on MalwareBazaar
TLSH	T100464A13BA5144AAC65ADA35C469A3F165207C881F71A3E3EB20F7763F316D44EF8B60
gimphash	56cb428772a4ed94a16ba932787e50b9c997e5421266be2363ba6ae9b5843a86
TrID	41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 26.1% (.EXE) Win64 Executable (generic) (10523/12/4) 12.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.1% (.ICL) Windows Icons Library (generic) (2059/9) 5.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	b0808a8c8c8a8030 (2 x CobaltStrike)
Reporter	obfusor
Tags:	Cobalt Strike exe

Intelligence

File Origin

# of uploads :

# of downloads :

349

Origin country :

Vendor Threat Intelligence

Malware family:

cobaltstrike

ID:

File name:

DE591848.exe

Verdict:

Malicious activity

Analysis date:

2023-07-17 08:48:21 UTC

Tags:

cobaltstrike

Link:

https://app.any.run/tasks/ae19b84f-a62d-4bef-8ede-20fbeffdff62

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/422156/

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending an HTTP GET request

Verdict:

No Threat

Threat level:

2/10

Confidence:

100%

Tags:

anti-debug golang greyware

Link:

https://www.filescan.io/uploads/64b4ffcefeab465ae3505460/reports/6c7c468e-b779-42a8-850a-8e0e9295954d/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d9ef56a29627c7dddd5b7422d97c8ce56e6ae722e34d8d034b1fdac649357913

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/a73c0f56-8439-43c8-b8c6-6fad6a74ce05

Result

Threat name:

CobaltStrike

Detection:

malicious

Classification:

troj.evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1274287

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Malicious sample detected (through community Yara rule)

Potentially malicious time measurement code found

Yara detected CobaltStrike

Behaviour

Behavior Graph:

Download SVG

Detection:

cobaltstrike

Link:

https://mwdb.cert.pl/sample/d9ef56a29627c7dddd5b7422d97c8ce56e6ae722e34d8d034b1fdac649357913/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3hxvniuwe7d53xk3oqrns7em4vxgvzzc4ngy2a2ld7nmmsjvpejq._file

Verdict:

malicious

Label(s):

cobaltstrike

CobaltStrike

eabb8e162f4c30c1157b0a4758ca5076f18cf4e31d7571020635dedd8d51c795

CobaltStrike

Result

Malware family:

cobaltstrike

Score:

10/10

Tags:

family:cobaltstrike botnet:0 botnet:391144938 backdoor trojan

Link:

https://tria.ge/reports/230717-kpavgaah85/

Behaviour

Cobaltstrike

Malware Config

C2 Extraction:

http://123.249.100.157:80/owa/

Unpacked files

SH256 hash:

d9ef56a29627c7dddd5b7422d97c8ce56e6ae722e34d8d034b1fdac649357913

MD5 hash:

5b4cec97066d00352d706b03893004bb

SHA1 hash:

d6811c747aa1cd9e28c84ef356e5ff2b130d8a72

Link:

https://www.unpac.me/results/afae2e0e-0e46-45ea-863f-c94382c78bae/

Malware family:

CobaltStrike

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d9ef56a29627/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d9ef56a29627c7dddd5b7422d97c8ce56e6ae722e34d8d034b1fdac649357913

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	Golangmalware Create hunting rule
Author:	Dhanunjaya
Description:	Malware in Golang

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	golang_duffcopy_amd64 Create hunting rule

Rule name:	HiveRansomware Create hunting rule
Author:	Dhanunjaya
Description:	Yara Rule To Detect Hive V4 Ransomware

Rule name:	identity_golang Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/422156/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample