MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dff1da3407eaf5a16558d8561b42720d9382dbbee8b9169847a6e1560b4250df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 4


Intelligence 4 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dff1da3407eaf5a16558d8561b42720d9382dbbee8b9169847a6e1560b4250df
SHA3-384 hash: f81f6bf8ff04ac300689dfa9dfe717d8e305e483c67ca597003f4a3f3c6a3cd066e3d31ca0749dec7c9d92a1b0d895e8
SHA1 hash: 0c4916330fd2a799ebb2c7454e297b8430269c0c
MD5 hash: 8990d02d8d271b75d0ea986154d55a7d
humanhash: lima-muppet-papa-mockingbird
File name:8990d02d8d271b75d0ea986154d55a7d.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:284'160 bytes
First seen:2020-06-11 16:10:21 UTC
Last seen:2020-06-11 16:45:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 14c880d25a4c148062626b35d23ad003 (2 x CobaltStrike)
ssdeep 3072:/9f/CVEVq0cQNe4YG9NU7dC6RmYvUYN7p0y1WFVqNYvuee1BdF/jJz1:1f+Uq0cQN9Yn7RmOFKdWYvueUJVz1
Threatray 66 similar samples on MalwareBazaar
TLSH 6054BDE5CEE42197CB64BBBF4B072EA570FA6224792460832907D372117DC28B9F745A
Reporter oppimaniac
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
2
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/9044/
Detection(s):
SecuriteInfo.com.Trojan.Siggen7.54626.8329.11979.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Cometer
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 16:12:08 UTC
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=37y5unah5l22czky3blbwqtsbwjyfw565c4rngchu3qvmc2ckdpq._file
Verdict:
malicious
Similar samples:
178bba892544670c9b347112461fc5443e02bd5a7685c9c29a4218dcf64eb25c
CobaltStrike
1a9bbebde954b27cbf6006128e1a22bdfa81d4ea853ba99bab4ec3333ea0bb89
CobaltStrike
2610754a99eb906bc26243eff669ca156c0b0cfb56875fc93ec17a607c95cfb4
CobaltStrike
514de96ef99941a0c9712622848b687b402b0635a4bb45cf1cee0002fe8cdfcd
CobaltStrike
8b855b57f8cd532db46946a38f929e5e5d43d7c1c5ea09a5b51c21097143a282
CobaltStrike
9a8b757fa40f9f6ee20d070db2801a48b9f7129ca385d6b52bb754cc8b72920b
CobaltStrike
a2c804408646e8c0481d3ba30a49482721857f540ecabc32c1de77cb91860c64
CobaltStrike
b40c8fcb20acf66db418078f0d6099145b220dc056d095beb54665faf6c726c7
CobaltStrike
e571cd3a4c0744cb3c5443b868577adced331a7545fcb6e2ed0efbe7506a2f9b
CobaltStrike
fb01851fc2be012833865bd37f81fa98f6a27131bb660e5b01c5eedb8070ceab
CobaltStrike
+ 56 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-5j67gm712a/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Beacon_K5om
Create hunting rule
Author:Florian Roth
Description:Detects Meterpreter Beacon - file K5om.dll
Reference:https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html
Rule name:CobaltStrike_Unmodifed_Beacon
Create hunting rule
Author:yara@s3c.za.net
Description:Detects unmodified CobaltStrike beacon DLL
Rule name:Leviathan_CobaltStrike_Sample_1
Create hunting rule
Author:Florian Roth
Description:Detects Cobalt Strike sample from Leviathan report
Reference:https://goo.gl/MZ7dRg
Rule name:Malware_QA_vqgk
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file vqgk.dll
Reference:VT Research QA
Rule name:PowerShell_Susp_Parameter_Combo
Create hunting rule
Author:Florian Roth
Description:Detects PowerShell invocation with suspicious parameters
Reference:https://goo.gl/uAic1X
Rule name:ReflectiveLoader
Create hunting rule
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:Reflective_DLL_Loader_Aug17_2
Create hunting rule
Author:Florian Roth
Description:Detects Reflective DLL Loader - suspicious - Possible FP could be program crack
Reference:Internal Research
Rule name:WiltedTulip_ReflectiveLoader
Create hunting rule
Author:Florian Roth
Description:Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Reference:http://www.clearskysec.com/tulip

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/9044/

Comments