MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4ffdbfb5878a94d27139e2e7ff3b5b91944e1434935028a3c34894988b353bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CobaltStrike

Vendor detections: 12

Intelligence 12 IOCs YARA 2 File information Comments

SHA256 hash:	e4ffdbfb5878a94d27139e2e7ff3b5b91944e1434935028a3c34894988b353bf
SHA3-384 hash:	0d129091bd134508ef37fae194cf42437976def2f9eb96be611c35ccd3d5d2eb1cfe22a38c68f92352635251ecc596f4
SHA1 hash:	fbc0689531ee4ff448456ff6dc6eb20748df035b
MD5 hash:	3aa3d7d310dc19ad19d740e0c50432a0
humanhash:	zulu-alpha-asparagus-carbon
File name:	Ehki64.dll
Download:	download sample
Signature	CobaltStrike Create hunting rule
File size:	1'018'880 bytes
First seen:	2022-08-23 23:21:52 UTC
Last seen:	2022-08-24 00:06:45 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	21dd87f0ffdcf325b5c86d81ee11ce38 (1 x CobaltStrike)
ssdeep	24576:661ITk6t8Aq+XrtzF8Y8EcghapQe7yjQDf54NZm28RQAu6he1XJl/xGzbQgICdh5:661ITk6qAq+XrtzyY8EVhapQe7yjQDfT
Threatray	1'274 similar samples on MalwareBazaar
TLSH	T10925F747EABA51F4D8B6D23996232337FCB1B4598734A7C38685690B1F61BF0923D384
TrID	48.7% (.EXE) Win64 Executable (generic) (10523/12/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter	malware_traffic
Tags:	64-bit Beacon Cobalt Strike CobaltStrike dll exe

malware_traffic

File description: 64-bit DLL for Cobalt Strike stager seen on 2022-08-23
Run method: regsvr32.exe [filename]

Intelligence

File Origin

# of uploads :

# of downloads :

801

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Ehki64.dll

Verdict:

No threats detected

Analysis date:

2022-08-23 23:23:28 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/04ced0f0-880f-443f-b90a-b24fb2441877

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/300680/

Detection(s):

SecuriteInfo.com.Variant.Tedy.176857.6833.23333.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

cobalt greyware

Link:

https://www.filescan.io/uploads/6305611ecdc72e865b897f0b/reports/843e5658-78b3-4349-948c-70aee23429e8/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Cobalt Strike

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5cf9585f-5429-4b8e-b36f-277aa7659d05

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1056659

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

cobaltstrike

Link:

https://mwdb.cert.pl/sample/e4ffdbfb5878a94d27139e2e7ff3b5b91944e1434935028a3c34894988b353bf/

Threat name:

Win64.Backdoor.CobaltStrike

Status:

Malicious

First seen:

2022-08-23 23:22:10 UTC

File Type:

PE+ (Dll)

AV detection:

21 of 40 (52.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4t75x62ypcuu2jyttyxh745vxemujykdje2qfcr4gseutcftko7q._file

Verdict:

malicious

Label(s):

cobaltstrike

CobaltStrike

2cb4d628278053eba42c82d58fb894c230451ffe70d519ff79c5f1cc76f32fd9

CobaltStrike

5efe564a2c779adebab8e664d524a0cfd026c8ab3a57527bd1d821245ffc2a8c

CobaltStrike

74ace0111970edf84a676c96b0c8180b2f2f6bc0a3f8e7bd1db4c9505e7e1d17

CobaltStrike

9122991758a93293f0ec4db1de3a04927f583b08751a553d235d5fdc1b254bd4

CobaltStrike

936861ea91e37611908b21310d461eb7435f2912e9a7576cee22ce22342d659b

CobaltStrike

99be525b748064edaa30caa911b1122187139c463ad29068c3ee5cf69eed774e

CobaltStrike

a7a0025d77b576bcdaf8b05df362e53a748b64b51dd5ec5d20cf289a38e38d56

CobaltStrike

a9c4eafcff0567c68919c93ddf8baa769392e92706e6b35f7b989310d70f732f

CobaltStrike

+ 1'264 additional samples on MalwareBazaar

Result

Malware family:

cobaltstrike

Score:

10/10

Tags:

family:cobaltstrike botnet:0 backdoor trojan

Link:

https://tria.ge/reports/220823-3cj7gseba5/

Behaviour

Program crash

Cobaltstrike

Malware Config

C2 Extraction:

http://jejonebew.com:443/remove.js

Unpacked files

SH256 hash:

e4ffdbfb5878a94d27139e2e7ff3b5b91944e1434935028a3c34894988b353bf

MD5 hash:

3aa3d7d310dc19ad19d740e0c50432a0

SHA1 hash:

fbc0689531ee4ff448456ff6dc6eb20748df035b

Link:

https://www.unpac.me/results/84db5888-2467-499c-bec6-1f7ddf22a4b9/

Malware family:

CobaltStrike

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e4ffdbfb5878/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e4ffdbfb5878a94d27139e2e7ff3b5b91944e1434935028a3c34894988b353bf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com