MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6084b5a88a98de3fdeb3a5dc69d7edd743b9ca9a3699812dac910fd036dabe5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Cobalt Strike

Vendor detections: 15

Intelligence 15 IOCs YARA 4 File information Comments

SHA256 hash:	e6084b5a88a98de3fdeb3a5dc69d7edd743b9ca9a3699812dac910fd036dabe5
SHA3-384 hash:	4fdb818c2817c5e04d96579822ec4ef81c5830cfc80beb887a5232c123d60bf1325b6884d4a383bfa7b2b31149cc949d
SHA1 hash:	45d7778629af8d8f1316cd21a9cf5cecc1617f79
MD5 hash:	c2e7fd434ffd26c4f073abd143308111
humanhash:	pizza-michigan-edward-thirteen
File name:	SecuriteInfo.com.Win64.MalwareX-gen.16284722
Download:	download sample
Signature	Cobalt Strike Create hunting rule
File size:	683'520 bytes
First seen:	2026-02-20 08:35:10 UTC
Last seen:	2026-02-20 09:29:36 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	8c39c4bfafdd9c3829fbad857456c604 (1 x Cobalt Strike)
ssdeep	12288:0CthcVTaB4/ydUNGBQKA3ggCgLwf4HvWooU3Mkqt:0CthcadUNdT3SAHvB4
TLSH	T107E45D4AB7B440F5D066C13AC9128B6AE7F2BC514B70834F435197AF5F376A19F2A322
TrID	68.6% (.EXE) InstallShield setup (43053/19/16) 10.4% (.EXE) Win64 Executable (generic) (6522/11/2) 8.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 3.2% (.ICL) Windows Icons Library (generic) (2059/9) 3.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	Cobalt Strike exe

Intelligence

File Origin

# of uploads :

# of downloads :

107

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

H64.exe

Verdict:

No threats detected

Analysis date:

2026-01-16 06:34:34 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/287ff4ff-6e6d-4e17-bcd0-f4353cc232bd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

CobaltStrikeStager

Link:

https://www.capesandbox.com/analysis/53902/

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.16284722.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6969dbf9ef906a21abcdacf9

Tags:

cobaltstrike cobalt

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Launching the default Windows debugger (dwwin.exe)

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context crypt explorer fingerprint keylogger lolbin microsoft_visual_cc soft-404

Link:

https://www.filescan.io/uploads/69981ccd91ad9169e532e4b2/reports/96dd05a6-392a-4f10-bf7f-9e44ba5a3ad4/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/e6084b5a88a98de3fdeb3a5dc69d7edd743b9ca9a3699812dac910fd036dabe5

Result

Gathering data

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-01-16T03:52:00Z UTC

Last seen:

2026-01-16T04:20:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/e6084b5a88a98de3fdeb3a5dc69d7edd743b9ca9a3699812dac910fd036dabe5/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/c0881ea5-11bb-4cd5-9a20-df51d237b9ce

Score:

75%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/e6084b5a88a98de3fdeb3a5dc69d7edd743b9ca9a3699812dac910fd036dabe5

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e6084b5a88a98de3fdeb3a5dc69d7edd743b9ca9a3699812dac910fd036dabe5/

Verdict:

Malicious

Threat:

Family.COBALTSTRIKE

Link:

https://tip.neiki.dev/file/e6084b5a88a98de3fdeb3a5dc69d7edd743b9ca9a3699812dac910fd036dabe5

Threat name:

Win64.Backdoor.Swrort

Status:

Suspicious

First seen:

2026-01-16 06:34:36 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4yeewwuivgg6h7plhjo4nhl63v2dxhfjunuzqew2zeip2a3nvpsq._file

Verdict:

malicious

Label(s):

metasploit

cobaltstrike

Similar samples:

error

Cobalt Strike

Result

Malware family:

cobaltstrike

Score:

10/10

Tags:

family:cobaltstrike backdoor trojan

Link:

https://tria.ge/reports/260220-kg7t8sfx2h/

Behaviour

Suspicious use of SetWindowsHookEx

Drops file in Windows directory

Cobaltstrike

Cobaltstrike family

Malware Config

C2 Extraction:

http://repshd.com:443/Menus.aspx

Unpacked files

SH256 hash:

e6084b5a88a98de3fdeb3a5dc69d7edd743b9ca9a3699812dac910fd036dabe5

MD5 hash:

c2e7fd434ffd26c4f073abd143308111

SHA1 hash:

45d7778629af8d8f1316cd21a9cf5cecc1617f79

Link:

https://www.unpac.me/results/1faed660-8722-4371-a3c0-81cffd17bd28/

Malware family:

CobaltStrike

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e6084b5a88a9/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e6084b5a88a98de3fdeb3a5dc69d7edd743b9ca9a3699812dac910fd036dabe5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	skip20_sqllang_hook Create hunting rule
Author:	Mathieu Tartare <mathieu.tartare@eset.com>
Description:	YARA rule to detect if a sqllang.dll version is targeted by skip-2.0. Each byte pattern corresponds to a function hooked by skip-2.0. If $1_0 or $1_1 match, it is probably targeted as it corresponds to the hook responsible for bypassing the authentication.
Reference:	https://www.welivesecurity.com/