MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9e56f5fe49f42aef7c4d6039c94b19c9a3232c896cf8235237725e831650fb6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9e56f5fe49f42aef7c4d6039c94b19c9a3232c896cf8235237725e831650fb6
SHA3-384 hash: 793d6b257088e76c9ee71ffcf1bdf6d16b294db782434516844db99aca21812a5a3709094a74fc2d1dfa0f1d6708f46d
SHA1 hash: 621a932dd16197cb64a0a86af41f11cb4708540c
MD5 hash: 1510008e408bedbf8e9e0ad731e8952e
humanhash: robin-seventeen-romeo-lactose
File name:flashplayer_install_cn.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:3'027'198 bytes
First seen:2021-07-23 11:00:15 UTC
Last seen:2021-07-23 11:50:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 49152:284jzswhuWofVUUoH75TDnxTd6HOPS2CLuD14mI0ND1l+ZHeSNQQEHt901JL3+fC:2LuWo0H1/xT0HOPV1lRN5l8WQEN90/TX
Threatray 463 similar samples on MalwareBazaar
TLSH T185E52302F94348F2C1A31D31492CFB75A67966601F29AEAFA7D04A5EDE300D1EF35693
dhash icon c8c49aa9acd6ea86 (3 x CobaltStrike, 1 x Arechclient2, 1 x BadRabbit)
Reporter JAMESWT_WT
Tags:182.161.69.158 27.124.34.236 CobaltStrike exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
508
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
flashplayer_install_cn.exe
Verdict:
Malicious activity
Analysis date:
2021-07-23 11:03:20 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3c061a1f-2aea-4b79-9a69-bcaf3bce3e41

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/173596/
Detection(s):
SecuriteInfo.com.Gen.Variant.Razy.582340.18684.14597.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d1218b90-a950-4d90-9b68-9e81c4785655
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/820707
Signature
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Sets debug register (to hijack the execution of another thread)
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f9e56f5fe49f42aef7c4d6039c94b19c9a3232c896cf8235237725e831650fb6/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-07-17 02:48:09 UTC
File Type:
PE (Exe)
Extracted files:
275
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
3175976cea0ac6b13312f1922423fca3f3d0bf99848f6b575c1063ed0f0cb8f4
CobaltStrike
59c8046d5881928e5a24722e97f5fb8a480b6039728c0e31062c62b82eca75bb
CobaltStrike
6aab235d3e2c5d65a036d081f65a694c60ce9289c20c9bb386dde89bc31099b3
CobaltStrike
6ee8f6a0c514a5bd25f7a32210f4b3fe878d9d417a7ebe07befc285131bae10e
CobaltStrike
6fc307063c376b8be2d3a9545959e068884d9cf7f819b176adf676fc4addef7d
CobaltStrike
77e4776f6db16b38b2bd6cd494017379be4cb291caab5300764c9d2857c49108
CobaltStrike
95469ab7bcbc64c662be3cf631efead7c2dcaa527ed68d98a7df16e125091311
CobaltStrike
a8f0dbc38f4fa81b8dc71d6a69df4a5a9963ad57de7c491a61044dbe42f586e5
CobaltStrike
de17e583a4d112ce513efd4b7cb575d272dcceef229f81360ebdfa5a1e083f11
CobaltStrike
e52ea54cfe3afd93a53e368245c5630425e326291bf1b2599b75dbf8e75b7aeb
CobaltStrike
+ 453 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike backdoor trojan
Link:
https://tria.ge/reports/210723-aqbtap6a26/
Behaviour
Modifies Internet Explorer settings
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Loads dropped DLL
Executes dropped EXE
Cobaltstrike
Suspicious use of NtCreateProcessExOtherParentProcess
Malware Config
C2 Extraction:
http://182.161.69.158:3399/fTRQ
Unpacked files
SH256 hash:
467f6766c0fe82abc9286b530d7fa455360c8c7f20a7f28461c54873e4e4de21
MD5 hash:
6be622c4fd3a217b3f45dcd0b1897ffe
SHA1 hash:
0d31265517b835028a81eaf4e16dd3b60d4bc874
Link:
https://www.unpac.me/results/22ae88f5-0c64-4be6-9db0-7fe3bd0eef5e/
Parent samples :
e8d6393b63beba6b6cad43f7068f597f9a9c89effba80917412c3f438214ec5c
1eb83f805c41a946b3cf639512ddfe1da13fce7aca90270448f1b03c343befff
c513dde23b6e4d4274696e7598f01f0bc96953ad14556fb7de24c765ab574327
f52ed6bc805585d9e81b15a327af3ecbccc67aac180dff55968b5133035ce74d
b09326eda96f66176f54837d11d485a281dd89f24addc68f2c1e5cfedffe90e3
490c76da1ec8a15a782850b4468cc7ab780ce8cc436d7b490c280588864940cf
363e545ebbeb5eafa15f17986c7e90abebe28774b7b4bb2c1fcb2ff64c9158b8
021cdda10106e4db66873cd411ae3ea1d63ce01a0de1889f658d73c84ea00c8e
68ad2b97e4e2c2e2dedd7b7cbb3a0483c09948513f849bcd22ebeee1f8f40cd3
797c029eb74037b438d4c8eebc774dd45c243e86570d0a2118b168ea7472ca0d
a3ee42d49a63d91f51e144c2372002385da3573c8179ed743eef439904a6cdf4
55d421ed6221bf7cb9cfc4a78c3b7dd8407f19933fd26af3adb4f659bfe81abb
3803477a8eaad24fbd1fb71245a009f371eab35186065534bb14ae5dc41f8e4b
e88a142edb195e0d7e73616f3f5edc8a8ae6fd811c2985ac591c0925122ca8ee
66a517357eb8d9d77f8e4f1e67bcb3d3ad36b95010ae2a47caef8fe9018bcfe6
0916b368912885a4b72e1f309de846041bcbb3b74e478964f11797f0e4ace419
4c5b6f817e37e530c3440d02fcfd808aaef1e15f880fc9cdb43799ecc86bb1e9
d0d9d1a383cd3123e3a740793e4e9dab17701dd26856c3d13bdd84aa9b6f3c44
0504da7e2670ac33821b1d29ab8e430bd262a873fd07dfae680e7816c705cdd2
5783db0ba968957f967255d34b62546fdd3f6e70aa65b2b3fae44228bf6441ca
SH256 hash:
94bf4afd3a77d76311159daa2f19643a7f7d1e2c4b37807651b328feeef34668
MD5 hash:
1115be7832a7fa6005cb06aa20cdbb5c
SHA1 hash:
d0cf4dcc15749f031b4f5631bd603daf3bae1696
Link:
https://www.unpac.me/results/22ae88f5-0c64-4be6-9db0-7fe3bd0eef5e/
SH256 hash:
a389d40075ebce6f0a85f2ed93afe760b866bf34b78c3326447c518e83bc39aa
MD5 hash:
1fed232a2c4eb9efc000da3fd0f6fb6e
SHA1 hash:
ad5bee14b9300dc21b9d42408ddf99984afb43a5
Link:
https://www.unpac.me/results/22ae88f5-0c64-4be6-9db0-7fe3bd0eef5e/
SH256 hash:
f9e56f5fe49f42aef7c4d6039c94b19c9a3232c896cf8235237725e831650fb6
MD5 hash:
1510008e408bedbf8e9e0ad731e8952e
SHA1 hash:
621a932dd16197cb64a0a86af41f11cb4708540c
Link:
https://www.unpac.me/results/22ae88f5-0c64-4be6-9db0-7fe3bd0eef5e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f9e56f5fe49f42aef7c4d6039c94b19c9a3232c896cf8235237725e831650fb6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/173596/

Comments