🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f65bf4180cc2a75e1897ef3675b1ddeb72e04dd884ff7a8566cc7104b6c26e2a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Cobalt Strike


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f65bf4180cc2a75e1897ef3675b1ddeb72e04dd884ff7a8566cc7104b6c26e2a
SHA3-384 hash: 71596e8bc9040b56a99019925e7c4c2a3d37b3b1869b02fa1312768d0cb63e607c80a397eb3cc29cd88a4f940fa3ec66
SHA1 hash: 6945abc3f4670ae001b22fd59670e3336ef77b62
MD5 hash: 196c296463a4e3596f031f9bf492665f
humanhash: lamp-one-march-violet
File name:f65bf4180cc2a75e1897ef3675b1ddeb72e04dd884ff7a8566cc7104b6c26e2a
Download: download sample
Signature Cobalt Strike
Create hunting rule
File size:176'544 bytes
First seen:2024-08-31 09:44:35 UTC
Last seen:2024-08-31 10:18:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3650c83ce97dfda9cdbfb2fc40f4282d (1 x Cobalt Strike)
ssdeep 768:euef6Rn2q5+tf2NI1BZmYZ76gkHYPxCBX4loBU534vi3yFIcTqGUD:eHf7qwtF976goYpCooo46guD
Threatray 1 similar samples on MalwareBazaar
TLSH T1DB04F982E97DFC52F93CB5F0ECED9A225CAC2C1E00F7387535B6B26A86379255B00255
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10523/12/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
File icon (PE):PE icon
dhash icon d4dcd0d2d6d2d0c8 (1 x Cobalt Strike)
Reporter JAMESWT_WT
Tags:119-45-147-28 Cobalt Strike exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
377
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f65bf4180cc2a75e1897ef3675b1ddeb72e04dd884ff7a8566cc7104b6c26e2a
Verdict:
No threats detected
Analysis date:
2024-08-31 09:45:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e598e4b6-ce1c-4b5d-964e-5d3489a2cd22

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win64.MalwareX-gen.29605.9214.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66d2e622a0c486d2f793b92a
Tags:
Encryption Infostealer Network Stealth Meterpreter
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
lolbin masquerade meterpreter microsoft_visual_cc obfuscated overlay packed shell32
Link:
https://www.filescan.io/uploads/66d2e6203c4b518fb3a5709f/reports/14e9f1af-cd0d-47b4-9bde-acc92e12160b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/f65bf4180cc2a75e1897ef3675b1ddeb72e04dd884ff7a8566cc7104b6c26e2a
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e6b39542-599a-44d9-9a06-28ec8ba0e06b
Result
Threat name:
CobaltStrike, Metasploit
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1502169
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CobaltStrike
Yara detected Metasploit Payload
Behaviour
Behavior Graph:
Download SVG
Score:
30%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/f65bf4180cc2a75e1897ef3675b1ddeb72e04dd884ff7a8566cc7104b6c26e2a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f65bf4180cc2a75e1897ef3675b1ddeb72e04dd884ff7a8566cc7104b6c26e2a/
Threat name:
Win64.Backdoor.Meterpreter
Create hunting rule
Status:
Malicious
First seen:
2024-08-28 12:49:00 UTC
File Type:
PE+ (Exe)
Extracted files:
46
AV detection:
12 of 38 (31.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6zn7igamyktv4gex543hlmo55nzoatoyqt7xvblgzryqjnwcnyva._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
f65bf4180cc2a75e1897ef3675b1ddeb72e04dd884ff7a8566cc7104b6c26e2a
Cobalt Strike
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/240831-lq26saxeke/
Malware Family:
n/a
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ff609d77-92d1-412d-b87b-a7ccc7b29af5
Unpacked files
SH256 hash:
f65bf4180cc2a75e1897ef3675b1ddeb72e04dd884ff7a8566cc7104b6c26e2a
MD5 hash:
196c296463a4e3596f031f9bf492665f
SHA1 hash:
6945abc3f4670ae001b22fd59670e3336ef77b62
Link:
https://www.unpac.me/results/6059ac1d-5fdb-4904-9912-820e94689218/
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f65bf4180cc2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f65bf4180cc2a75e1897ef3675b1ddeb72e04dd884ff7a8566cc7104b6c26e2a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_Nimplant_PE
Create hunting rule
Author:daniyyell
Description:Detects malicious nimplant variant PE malware.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::GetStartupInfoA
KERNEL32.dll::GetCommandLineW

Comments