MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da299be7f0cc9d71cdea150c0951dd6e4b121b65882a5bf2826f59dd02ea0ab5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 11


Intelligence 11 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da299be7f0cc9d71cdea150c0951dd6e4b121b65882a5bf2826f59dd02ea0ab5
SHA3-384 hash: e01e59d1b9a27ef4eba84daaedfd1567d008014e0b1ca95e925fa392a187b9338a88b4658737cfdf56728a25aa43f5ad
SHA1 hash: 05b6e192978b27ea1a7ee5ed4e3e1d24939d13e8
MD5 hash: a771d34f0efa34761d3a18371bc9655b
humanhash: hotel-stream-connecticut-emma
File name:da299be7f0cc9d71cdea150c0951dd6e4b121b65882a5bf2826f59dd02ea0ab5
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:113'152 bytes
First seen:2023-09-25 21:38:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b80f9a3caeabbd97ef3418216ac93c69 (2 x CobaltStrike)
ssdeep 1536:pDet0y4S/xry1STK1HT5SnwerPJFwcINaocFEzsWTdg9dltEeKRUpQ:9et0Iy1DB5aw4PLfIN1iEbQXEeKRUp
TLSH T1B9B36C4773A508BBF4779639C8930E49E37678110760AFAF07A087561F633A18D3EBA5
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter StrangerealIntel
Tags:Cobalt Strike exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
329
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
CobaltStrikeStager
Create hunting rule
Link:
https://www.capesandbox.com/analysis/451126/
Detection(s):
Win.Trojan.MSShellcode-5
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm cobalt cobaltstrike greyware
Link:
https://www.filescan.io/uploads/6511fdf932ffdb7a7a141ced/reports/2614f014-5386-4bc5-99a8-b23b81674106/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/da299be7f0cc9d71cdea150c0951dd6e4b121b65882a5bf2826f59dd02ea0ab5
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d6bb7c3d-8a96-41a5-b0e1-960ff38add66
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1314171
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1314171 Sample: czy5nZM06O.exe Startdate: 25/09/2023 Architecture: WINDOWS Score: 96 34 Found malware configuration 2->34 36 Malicious sample detected (through community Yara rule) 2->36 38 Antivirus / Scanner detection for submitted sample 2->38 40 4 other signatures 2->40 8 loaddll64.exe 7 2->8         started        process3 process4 10 rundll32.exe 8->10         started        13 rundll32.exe 6 8->13         started        16 cmd.exe 1 8->16         started        18 28 other processes 8->18 dnsIp5 42 System process connects to network (likely due to code injection or exploit) 10->42 30 121.5.22.133, 21786, 49724, 49727 ONQ-AS-APOnQAU China 13->30 20 WerFault.exe 20 9 13->20         started        22 rundll32.exe 6 16->22         started        32 192.168.2.1 unknown unknown 18->32 24 WerFault.exe 9 18->24         started        26 WerFault.exe 9 18->26         started        signatures6 process7 process8 28 WerFault.exe 22->28         started       
Detection:
cobaltstrike
Create hunting rule
Link:
https://mwdb.cert.pl/sample/da299be7f0cc9d71cdea150c0951dd6e4b121b65882a5bf2826f59dd02ea0ab5/
Threat name:
Win64.Backdoor.CobaltStrikeBeacon
Create hunting rule
Status:
Malicious
First seen:
2023-06-15 13:44:00 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3iuzxz7qzsoxdtpkcugasuo5nzfreg3fravfx4ucn5m52axkbk2q._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike backdoor trojan
Link:
https://tria.ge/reports/230925-1hlw6add38/
Behaviour
Suspicious use of WriteProcessMemory
Blocklisted process makes network request
Cobaltstrike
Malware Config
C2 Extraction:
http://121.5.22.133:21786/hY4h
Unpacked files
SH256 hash:
da299be7f0cc9d71cdea150c0951dd6e4b121b65882a5bf2826f59dd02ea0ab5
MD5 hash:
a771d34f0efa34761d3a18371bc9655b
SHA1 hash:
05b6e192978b27ea1a7ee5ed4e3e1d24939d13e8
Link:
https://www.unpac.me/results/1a0654e8-2f9b-4f40-b69a-239d69f339e7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/da299be7f0cc9d71cdea150c0951dd6e4b121b65882a5bf2826f59dd02ea0ab5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobaltbaltstrike_RAW_Payload_http_stager_x64
Create hunting rule
Author:Avast Threat Intel Team
Description:Detects CobaltStrike payloads
Reference:https://github.com/avast/ioc
Rule name:CobaltStrikeStager
Create hunting rule
Author:@dan__mayer <daniel@stairwell.com>
Description:Cobalt Strike Stager Payload
Rule name:CobaltStrike_Resources_Httpstager64_Bin_v3_2_through_v4_x
Create hunting rule
Author:gssincla@google.com
Description:Cobalt Strike's resources/httpstager64.bin signature for versions v3.2 to v4.x
Reference:https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse
Rule name:CobaltStrike__Resources_Httpstager64_Bin_v3_2_through_v4_x
Create hunting rule
Author:gssincla@google.com
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:Windows_Trojan_Metasploit_7bc0f998
Create hunting rule
Author:Elastic Security
Description:Identifies the API address lookup function leverage by metasploit shellcode
Rule name:Windows_Trojan_Metasploit_7bc0f998
Create hunting rule
Description:Identifies the API address lookup function leverage by metasploit shellcode
Rule name:Windows_Trojan_Metasploit_c9773203
Create hunting rule
Author:Elastic Security
Description:Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm
Rule name:Windows_Trojan_Metasploit_c9773203
Create hunting rule
Description:Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/451126/

Comments