MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f01d421087151c6cd2cad26e0aecfa95cd81553b10c481fd6fafa8aeb57b787e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 14


Intelligence 14 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f01d421087151c6cd2cad26e0aecfa95cd81553b10c481fd6fafa8aeb57b787e
SHA3-384 hash: 975579ea1eb70fdf462be55973749b39954dab869b988348b70d941de43f1d22b40f44df1864336cb10bb5a1410d7353
SHA1 hash: 49ab30cd9c5c3cf83d26aa57e4aae851a1a9e193
MD5 hash: dc5a49d77d8355e13604f43184abc996
humanhash: high-crazy-mike-autumn
File name:cs.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:228'864 bytes
First seen:2022-04-08 17:55:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 829da329ce140d873b4a8bde2cbfaa7e (259 x CobaltStrike)
ssdeep 6144:O443XR4S48C4BeBxi66thkbAzLks1YarGR8ej4rC5Jj:2rZMBIz+YLks1YarGR8PWj
Threatray 182 similar samples on MalwareBazaar
TLSH T1B424BEB0B41DBDA4F04B46B60D4EF0B2AD50EED7A99EA61B70F4A5059BCA573340F603
Reporter drb_ra
Tags:CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
290
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cobaltstrike_shellcode.exe
Verdict:
Malicious activity
Analysis date:
2022-04-08 17:55:42 UTC
Tags:
cobalt
Link:
https://app.any.run/tasks/e32695b1-f6a3-42c7-b0a0-740c6cc60f5d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/262214/
Detection(s):
Win.Exploit.D3b71c-9863766-0
Create hunting rule

SecuriteInfo.com.Crypt5.BLLV.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/13232/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug obfuscated
Link:
https://www.filescan.io/uploads/62507732cccdcb99472c558a/reports/880b0975-8d24-411a-ac4f-de0261e567dc/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Cobalt Strike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8df3fe6a-fbec-4c24-ab03-03935c5512cc
Result
Threat name:
CobaltStrike
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/973451
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Behaviour
Behavior Graph:
Download SVG
Detection:
cobaltstrike
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f01d421087151c6cd2cad26e0aecfa95cd81553b10c481fd6fafa8aeb57b787e/
Threat name:
Win32.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2022-04-08 17:56:06 UTC
File Type:
PE (Exe)
AV detection:
38 of 42 (90.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6aoueeehcuogzuwk2jxav3h2sxgycvj3cdcid7lpv6uk5nl3pb7a._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
0b4ebf0528180d7b88c4ccbd9a5364a46383edcccf0364045ee6d9d0555b63d1
CobaltStrike
922bc53f37d8f146b6bc6f14195c3dee3b668cb57e17f666db1bfd5ef5d722cf
CobaltStrike
aa71d1f8581296304caf7f0a046273e1db94101509319733dc973500dd03fdec
CobaltStrike
b4f6c11f8821d7f8463f29cb85ac120c21f4f55a69b5bc85fbe0bf691de472a8
CobaltStrike
c7f90e07d571707c42557c6169817834d791c438e964878729c941733b3c8ca6
CobaltStrike
+ 172 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220408-whz2kacgbk/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
f01d421087151c6cd2cad26e0aecfa95cd81553b10c481fd6fafa8aeb57b787e
MD5 hash:
dc5a49d77d8355e13604f43184abc996
SHA1 hash:
49ab30cd9c5c3cf83d26aa57e4aae851a1a9e193
Link:
https://www.unpac.me/results/d5a9eb7b-02ab-45b8-aa23-98bf3dfc9eb3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f01d421087151c6cd2cad26e0aecfa95cd81553b10c481fd6fafa8aeb57b787e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobaltbaltstrike_strike_Payload_XORed
Create hunting rule
Author:Avast Threat Intel Team
Description:Detects CobaltStrike payloads
Reference:https://github.com/avast/ioc
Rule name:CobaltStrikeBeacon
Create hunting rule
Author:ditekshen, enzo & Elastic
Description:Cobalt Strike Beacon Payload
Rule name:CobaltStrike_C2_Encoded_XOR_Config_Indicator
Create hunting rule
Author:yara@s3c.za.net
Description:Detects CobaltStrike C2 encoded profile configuration
Rule name:CS_beacon
Create hunting rule
Author:Etienne Maynier tek@randhome.io
Rule name:HKTL_CobaltStrike_Beacon_Strings
Create hunting rule
Author:Elastic
Description:Identifies strings used in Cobalt Strike Beacon DLL
Reference:https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
Rule name:HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5
Create hunting rule
Author:Florian Roth
Description:Detects strings found in CobaltStrike shellcode
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Rule name:HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5_RID361D
Create hunting rule
Author:Florian Roth
Description:Detects strings found in malware samples in APT report in DarkHydrus
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Rule name:HKTL_Win_CobaltStrike
Create hunting rule
Author:threatintel@volexity.com
Description:The CobaltStrike malware family.
Reference:https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
Rule name:malware_CobaltStrike_v3v4
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect CobaltStrike Beacon in memory
Reference:https://blogs.jpcert.or.jp/en/2018/08/volatility-plugin-for-detecting-cobalt-strike-beacon.html
Rule name:SUSP_XORed_Mozilla
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/262214/

Comments