🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9f8a8ecbbddfe4b11f81b7444e29bd068b281e125d35f1b01827d9d2af6260f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9f8a8ecbbddfe4b11f81b7444e29bd068b281e125d35f1b01827d9d2af6260f
SHA3-384 hash: 994b7e862db17618007a62699f8a72949f2695a9d1e6f9b2a9f17edb9e8348ad4c1f594fc6b0b11aa5229393dc6752bc
SHA1 hash: df3a263de1e16f853ebdce6e7eff4e2921258ee8
MD5 hash: b420be0523116b82cdab3bbb5f0a7247
humanhash: massachusetts-johnny-arizona-music
File name:e9f8a8ecbbddfe4b11f81b7444e29bd068b281e125d35f1b01827d9d2af6260f.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:392'057 bytes
First seen:2024-07-24 22:35:44 UTC
Last seen:2024-07-25 00:08:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash dd5de3b2d295c3d9997838a0821a588c (1 x CobaltStrike)
ssdeep 3072:a8r9AG6rpqcAL93tfz5sfIm1sgIkDHQtoI12aG9ZR5uZKuz3Tn4cr8BL4Ba:DqXr43tfz5MkSMPG943Tn4crS8Ba
Threatray 135 similar samples on MalwareBazaar
TLSH T1ED843885EEC56CD6C7052639699A5315E73CE392C3939B17492BB2341CC34F3AEC6A0E
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10523/12/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter Anonymous
Tags:Cobalt Strike exe


Avatar
Anonymous
this malware sample is very nasty!

Intelligence

File Origin
# of uploads :
2
# of downloads :
336
Origin country :
CN CN
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.CobaltStrike.86.22335.16508.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66a181d7cb3d02fa0e496afb
Tags:
Encryption Variant
Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug overlay
Link:
https://www.filescan.io/uploads/66a181d4dfa8b2fced4e2e5d/reports/c4646ba7-baac-4c90-900a-622697acb3e9/overview
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a5068e53-c2d6-428b-8e66-a02f687ef7a7
Result
Threat name:
CobaltStrike, Metasploit
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1482671
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (creates a PE file in dynamic memory)
Found API chain indicative of debugger detection
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Yara detected Metasploit Payload
Behaviour
Behavior Graph:
Download SVG
Score:
75%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e9f8a8ecbbddfe4b11f81b7444e29bd068b281e125d35f1b01827d9d2af6260f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e9f8a8ecbbddfe4b11f81b7444e29bd068b281e125d35f1b01827d9d2af6260f/
Threat name:
Win64.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2024-04-30 05:56:00 UTC
File Type:
PE+ (Exe)
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5h4kr3f33x7ewepydn2ejyu32bulfapbexjv6gybqj6z2kxweyhq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
02d8294472a9eced7393e727f12f120dd9e0794f8867469c8a4083c7e577dea6
CobaltStrike
26b2f12906c3590c8272b80358867944fd86b9f2cc21ee6f76f023db812e5bb1
CobaltStrike
96f1143875956621e590d05da84a3b75d498ecbf6afda44208894c2f51a8464b
CobaltStrike
9a7d2b2c96ee9b7b0ddc1665988d935a719f04cdb2b2dd331ec36aa4f6597506
CobaltStrike
ccf758b328692428403abce7c1d6126eb546e6a42649fa8efff3c625a262534b
CobaltStrike
d11d6fc860b3fc30b19004831fd789103eb27aa0b63c73cc5a37050169e37ed0
CobaltStrike
f2093c8228896204c3403526c88ff3ddb4d9c7369a043ebb0b1a69b44ce63cd2
CobaltStrike
f90014dc43ee89a2e8d146bc83cf462e50ef4de5cd17fda886f42c9631b9aee3
CobaltStrike
+ 125 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike backdoor trojan
Link:
https://tria.ge/reports/240724-2h8xcs1ekp/
Behaviour
Cobaltstrike
Malware Config
C2 Extraction:
http://45.144.136.27:65443/jquery-3.3.2.slim.min.js
Malware Family:
n/a
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/85965402-7cb2-4b78-8ed0-eefe8a10611d
Unpacked files
SH256 hash:
e9f8a8ecbbddfe4b11f81b7444e29bd068b281e125d35f1b01827d9d2af6260f
MD5 hash:
b420be0523116b82cdab3bbb5f0a7247
SHA1 hash:
df3a263de1e16f853ebdce6e7eff4e2921258ee8
Link:
https://www.unpac.me/results/c275e275-6f85-408b-8e04-ff3f8a1bb7b3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Pay2Key
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e9f8a8ecbbddfe4b11f81b7444e29bd068b281e125d35f1b01827d9d2af6260f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

CobaltStrike

Executable exe e9f8a8ecbbddfe4b11f81b7444e29bd068b281e125d35f1b01827d9d2af6260f

(this sample)

  
Link
https://bbs.kafan.cn/forum-31-1.html
  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetStartupInfoA

Comments