MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8a7ef753ed4933ab63b9c82282bc0246b7d3b1d54185b85dbf23a1aa3fd34fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f8a7ef753ed4933ab63b9c82282bc0246b7d3b1d54185b85dbf23a1aa3fd34fd
SHA3-384 hash: 607ab0c2daaeb0e0a2fd27df47cec94856ae62cce0cd1cdc2c2bf90cd3d3c5edd3715dd447df98f32941bc2449c2d568
SHA1 hash: 8ba0019b0af856d1006452f679e239ce66ecdb92
MD5 hash: b68cb8ceada9fed2b0b06625eac0e0a5
humanhash: massachusetts-lactose-ohio-north
File name:artifact5.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:19'456 bytes
First seen:2025-10-23 07:02:21 UTC
Last seen:2025-10-23 07:25:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 147442e63270e287ed57d33257638324 (158 x CobaltStrike, 21 x Cobalt Strike)
ssdeep 192:RV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2S+RIqUrWF8qa1Dojjgi:jqaCF31cix+Dc4zja6XSFF46gi
Threatray 370 similar samples on MalwareBazaar
TLSH T10C92E93FE31368E9C106D57885FF3732DCB53DB385A6971E2724D2B42E106A42EAE950
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10522/11/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter wanghe
Tags:CobaltStrike exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
160
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
artifact5.exe
Verdict:
No threats detected
Analysis date:
2025-10-23 07:00:44 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c47a9513-255c-495f-87ee-0c342c9e66ee

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeStager
Create hunting rule
Link:
https://www.capesandbox.com/analysis/33835/
Detection(s):
Win.Trojan.CobaltStrike-9044898-1
Create hunting rule

Win.Trojan.CobaltStrike-7899871-1
Create hunting rule

Win.Countermeasure.LoaderWinGeneric-9804845-2
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68f9d3dbad6ce0f5ad40e3f1
Tags:
cobaltstrike cobalt
Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Launching the default Windows debugger (dwwin.exe)
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug cobalt cobaltstrike obfuscated windows
Link:
https://www.filescan.io/uploads/68f9d3d511ff3db29f66da40/reports/aefdacde-ceab-4994-95ef-5e9489e9fbdc/overview
Verdict:
Malicious
Labled as:
Dump:Generic.ShellCode.Marte.2
Link:
https://www.hybrid-analysis.com/sample/f8a7ef753ed4933ab63b9c82282bc0246b7d3b1d54185b85dbf23a1aa3fd34fd
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-10-23T04:16:00Z UTC
Last seen:
2025-10-24T00:39:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Shelma.a PDM:Exploit.Win32.Generic Trojan.Win64.Shlem.sb HEUR:Trojan.Win64.CobaltStrike.gen HEUR:Trojan.Win32.Generic Trojan.Win64.Shelm.sb Trojan.Win64.Ogneglazka.g Trojan.Win64.CozyDuke.sb Trojan.Win32.Shelm.c Trojan.Win32.Shelm.a HEUR:Trojan.Win64.Shelma.a
Link:
https://opentip.kaspersky.com/f8a7ef753ed4933ab63b9c82282bc0246b7d3b1d54185b85dbf23a1aa3fd34fd/results?tab=lookup
Malware family:
Cobalt Strike
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d5abb289-4927-4412-85ae-42d20afe31e4
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f8a7ef753ed4933ab63b9c82282bc0246b7d3b1d54185b85dbf23a1aa3fd34fd
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/b68cb8ceada9fed2b0b06625eac0e0a5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f8a7ef753ed4933ab63b9c82282bc0246b7d3b1d54185b85dbf23a1aa3fd34fd/
Verdict:
Malicious
Threat:
Family.COBALTSTRIKE
Link:
https://tip.neiki.dev/file/f8a7ef753ed4933ab63b9c82282bc0246b7d3b1d54185b85dbf23a1aa3fd34fd
Threat name:
Win64.Backdoor.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2025-10-23 07:05:55 UTC
File Type:
PE+ (Exe)
AV detection:
32 of 37 (86.49%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ct665j62sjtvnr3tsbcqk6aervx2oy5kqmfxbo36i5bvi75gt6q._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
metasploit
Create hunting rule
Similar samples:
152379224a15b42053e050e607602658011184e9de949845accad6dd4b5dffe5
CobaltStrike
22a2f3d36e364fd7153731b015432e7ec172aa3522643f468caf91b1165ac9cf
CobaltStrike
2d4791c66db346075cc3811dedc19b66cdda13d8deb7ef3c5aa44843e8e61597
CobaltStrike
af9b4003d835cc2f9fbc573c5ac7994cbab3160253b5ea84c38b51452479d724
CobaltStrike
d51227236c746313a46222fb4e3c68031e7f4d77548b84753fd5d6c4af4f3cbd
CobaltStrike
error
CobaltStrike
+ 360 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike backdoor trojan
Link:
https://tria.ge/reports/251023-hw1clahm7y/
Behaviour
Cobaltstrike
Cobaltstrike family
Malware Config
C2 Extraction:
http://35.212.217.120:443/jquery-3.3.2.slim.min.js
Verdict:
Malicious
Tags:
red_team_tool cobalt_strike Win.Trojan.CobaltStrike-9044898-1
YARA:
win_cobaltstrike_pipe_strings_nov_2023 Windows_Trojan_CobaltStrike_7f8da98a
Link:
https://app.threat.zone/submission/08ba4e1e-0373-4125-a720-9afd15eec4b4
Unpacked files
SH256 hash:
f8a7ef753ed4933ab63b9c82282bc0246b7d3b1d54185b85dbf23a1aa3fd34fd
MD5 hash:
b68cb8ceada9fed2b0b06625eac0e0a5
SHA1 hash:
8ba0019b0af856d1006452f679e239ce66ecdb92
Link:
https://www.unpac.me/results/98d0992d-e153-418e-85cb-1e044e6c9cf6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f8a7ef753ed4933ab63b9c82282bc0246b7d3b1d54185b85dbf23a1aa3fd34fd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Windows_Trojan_CobaltStrike_7f8da98a
Create hunting rule
Author:Elastic Security
Rule name:win_cobaltstrike_pipe_strings_nov_2023
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects default strings related to cobalt strike named pipes

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/33835/

Comments