MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e091dd27aac2f45c59fbb43177efdeca98b6cc7f59194a6fe8d51286ff09a171. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Cobalt Strike

Vendor detections: 12

Intelligence 12 IOCs YARA 9 File information Comments

SHA256 hash:	e091dd27aac2f45c59fbb43177efdeca98b6cc7f59194a6fe8d51286ff09a171
SHA3-384 hash:	d4393414a09a8b90e0773143734e277bf5787f863a38eb6e96f98f9a524a1dec6c306cbebc553c5d7d25489abcd9661e
SHA1 hash:	912faf38c4abacab99b7c217a3f608ee6385e161
MD5 hash:	f313ada70224987aee015c52ab0308e1
humanhash:	football-papa-wisconsin-mobile
File name:	Rolex_file.exe
Download:	download sample
Signature	Cobalt Strike Create hunting rule
File size:	1'051'520 bytes
First seen:	2024-11-22 10:43:25 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	66a5b880a1d5b1c211f240b8a6f82efc (1 x Cobalt Strike)
ssdeep	12288:wWa4C4oOJKzZ2e8g7BwhsMdwYELHuSA+ye7TEPzzga+:wWa1L6I2Rg7BwhsMdMLJxXEi
Threatray	3 similar samples on MalwareBazaar
TLSH	T1F7259D17F74541A5E862DF31D5574152A3633C60A3208B87BBA8723E4EF2B9069373BB
TrID	43.3% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 27.6% (.EXE) Win64 Executable (generic) (10522/11/4) 13.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.3% (.EXE) OS/2 Executable (generic) (2029/13) 5.2% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
File icon (PE):
dhash icon	00eca2b2d6cc4d92 (3 x ValleyRAT, 1 x Cobalt Strike, 1 x CobaltStrike)
Reporter	JAMESWT_WT
Tags:	45-14-226-17 Cobalt Strike exe

Intelligence

File Origin

# of uploads :

# of downloads :

498

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Rolex_file.exe

Verdict:

Malicious activity

Analysis date:

2024-11-22 10:46:52 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/ce1ff1d3-3159-45b6-90b1-0e78b3eeb8e9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6740613ab31374f098336cec

Tags:

shellcode injection virus

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Restart of the analyzed sample

Creating a file

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Launching a process

Creating a window

Using the Windows Management Instrumentation requests

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

microsoft_visual_cc

Link:

https://www.filescan.io/uploads/674060748d2018acf26379e9/reports/6730c15b-015e-414a-b8e1-2dd4fb6c5fd3/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/e091dd27aac2f45c59fbb43177efdeca98b6cc7f59194a6fe8d51286ff09a171

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/b887fb43-cf73-48f4-b9c4-a7d2053b1899

Result

Threat name:

n/a

Detection:

suspicious

Classification:

evad

Score:

26 / 100

Link:

https://www.joesandbox.com/analysis/1560834

Signature

Found direct / indirect Syscall (likely to bypass EDR)

Behaviour

Behavior Graph:

Download SVG

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/e091dd27aac2f45c59fbb43177efdeca98b6cc7f59194a6fe8d51286ff09a171

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e091dd27aac2f45c59fbb43177efdeca98b6cc7f59194a6fe8d51286ff09a171/

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2024-11-20 16:48:08 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4ci52j5kyl2fywp3wqyxp366zkmlntd7lemuu37i2ujin7yjufyq._file

Verdict:

malicious

Label(s):

cobaltstrike

Cobalt Strike

error

Cobalt Strike

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery

Link:

https://tria.ge/reports/241122-mss7bsvnhn/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

cURL User-Agent

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Checks computer location settings

Malware Family:

n/a

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/2972c29d-bc91-4000-aae9-23f1e7cf3eca

Unpacked files

SH256 hash:

e091dd27aac2f45c59fbb43177efdeca98b6cc7f59194a6fe8d51286ff09a171

MD5 hash:

f313ada70224987aee015c52ab0308e1

SHA1 hash:

912faf38c4abacab99b7c217a3f608ee6385e161

Link:

https://www.unpac.me/results/1b6d1f7e-514f-49bb-8bc4-2019e9f0b4e6/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e091dd27aac2f45c59fbb43177efdeca98b6cc7f59194a6fe8d51286ff09a171

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

https://x.com/malwrhunterteam/status/1859908191246803036

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::OpenProcess KERNEL32.dll::CloseHandle WININET.dll::InternetCloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::GetStartupInfoW
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileA KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW SHLWAPI.dll::PathRemoveFileSpecW KERNEL32.dll::GetWindowsDirectoryW KERNEL32.dll::GetFileAttributesW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample