🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98
SHA3-384 hash: c3f7bac4b3b983fe4b5e5af5196d21cd83964ae535639093f389378c7f3a6e72a4ac3dcc19a63e2a453dc54cd0d9c9e4
SHA1 hash: 92b67e98138f65bbb6469afafb71cd49cde7a321
MD5 hash: 8f96176279d6d78c3e40044939e028e6
humanhash: glucose-nuts-romeo-delta
File name:90AQ.ps1
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:286'506 bytes
First seen:2023-03-20 16:25:44 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 6144:oxzX5tk9wGd8b6JDuwgCNx88x/4eVU68RgRXswQqn:+/kp8b6JDzxoqg8xRXQu
Threatray 479 similar samples on MalwareBazaar
TLSH T1DF548C973FA80D0DEB06F0256562B0C629D9276F6920C481A6F1C6E5E4F46267CFC7E3
Reporter Chainskilabs
Tags:Cobalt Strike ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
220
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.PowerShell.Agent-6.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PowerShell.Obfus-4.UNOFFICIAL
Create hunting rule

Win.Trojan.CobaltStrike-7917400-0
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cobaltstrike metasploit template
Link:
https://www.filescan.io/uploads/6418891d2fbc9ad18a0308bb/reports/4c18d7a3-b26c-4937-929c-829c55343e24/overview
Verdict:
Malicious
Labled as:
BZC.PZQ.Pantera.50
Link:
https://www.hybrid-analysis.com/sample/f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98
Result
Threat name:
CobaltStrike, Metasploit, ReflectiveLoad
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1197883
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Uses known network protocols on non-standard ports
Yara detected CobaltStrike
Yara detected MetasploitPayload
Yara detected ReflectiveLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 830791 Sample: 90AQ.ps1 Startdate: 20/03/2023 Architecture: WINDOWS Score: 100 18 Multi AV Scanner detection for domain / URL 2->18 20 Malicious sample detected (through community Yara rule) 2->20 22 Antivirus detection for URL or domain 2->22 24 7 other signatures 2->24 7 powershell.exe 32 2->7         started        process3 process4 9 powershell.exe 13 7->9         started        12 conhost.exe 7->12         started        dnsIp5 16 152.89.196.245, 49695, 49696, 49697 NEXTVISIONGB United Kingdom 9->16 14 conhost.exe 9->14         started        process6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98/
Threat name:
Script-PowerShell.Trojan.CobaltStrikeBeacon
Create hunting rule
Status:
Malicious
First seen:
2023-03-20 16:26:08 UTC
File Type:
Text (PowerShell)
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6qcnezyg54epaht5bc6sjzlsyurqqxzma5qbhegefzscmg6g36ma._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
26570ab9f442065765270e47672f1c486173fced5d1a4b32d4e4997fec9e58ad
CobaltStrike
2a2f594dc53b5be16a0ca9e5feaa1387012c1e5f1d50a0168aa3991c47966a67
CobaltStrike
5d897ac5c7c3fb20d6b3f34dbfd01fd10121ff446beb9166bcbbad5cf2818f64
CobaltStrike
721c6cd41fa38ac1ac3ef3c20f00d942dbf7299ac4ab0f0ad7325a4c006824c2
CobaltStrike
ae62ac2596c41db7d18fcfce29955d6b420a5783c0f27ca8d667caab3ec16398
CobaltStrike
da69111d0ba32fa46dfcf6dbb30d672d39bf5794951f5c4d69fb378eda4bd1ff
CobaltStrike
+ 469 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike botnet:100000 backdoor trojan
Link:
https://tria.ge/reports/230320-txh1gsgd9t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Blocklisted process makes network request
Cobaltstrike
Malware Config
C2 Extraction:
http://152.89.196.245:6789/match
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f404d26706ef/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
CobaltStrike
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:CobaltStrike_Resources_Template_x64_Ps1_v3_0_to_v4_x_excluding_3_12_3_13
Create hunting rule
Author:gssincla@google.com
Description:Cobalt Strike's resources/template.x64.ps1, resources/template.hint.x64.ps1 and resources/template.hint.x32.ps1 from v3.0 to v4.x except 3.12 and 3.13
Reference:https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse
Rule name:CobaltStrike__Resources_Template_x64_Ps1_v3_0_to_v4_x_excluding_3_12_3_13
Create hunting rule
Author:gssincla@google.com
Rule name:Msfpayloads_msf_ref
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Metasploit Payloads - file msf-ref.ps1
Reference:Internal Research
Rule name:Msfpayloads_msf_ref_RID2ED5
Create hunting rule
Author:Florian Roth
Description:Metasploit Payloads - file msf-ref.ps1
Reference:Internal Research
Rule name:SUSP_PowerShell_Base64_Decode
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects PowerShell code to decode Base64 data. This can yield many FP

File information

The table below shows additional information about this malware sample such as delivery method and external references.

anyrun
any.run
https://app.any.run/tasks/9a2d706f-a2ed-4699-8632-faa35d8d68cc

Comments