MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbe1b7e3984d33ae5f5756116aaddce9139849cf0364f4ca1edb74d8a273e766. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fbe1b7e3984d33ae5f5756116aaddce9139849cf0364f4ca1edb74d8a273e766
SHA3-384 hash: 07bf2acdbffe311a38019cdc06e5bf34c867fcfcfb4ddb8fac22142da8e30a16402d3fbf5768fd5b786a4e41264a26ba
SHA1 hash: 4415f5070569af1fefdf99f2deed3477e6ff9e05
MD5 hash: c5c31a6065e67a8555eb7ca0e37cfa8a
humanhash: apart-rugby-glucose-echo
File name:fbe1b7e3984d33ae5f5756116aaddce9139849cf0364f4ca1edb74d8a273e766
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:10'611'223 bytes
First seen:2021-01-28 13:32:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 809ea02d92fea89353f33279290e8c9f (4 x CobaltStrike, 1 x DemonWare, 1 x ValleyRAT)
ssdeep 196608:ZDmD1ciMn1uWJysVYvsO5/DIEVFKgd7148RmU/3ZlsPv9of3oP78C1fcpWB:xmqig8WJO/DIEBd71tN3ZWqAPZc4
Threatray 25 similar samples on MalwareBazaar
TLSH 41B633037B600C9DE2A58273ECF0043AD533B42B9718652B4E7D3B7169AB3A97EB4751
Reporter JAMESWT_WT
Tags:47.105.186.146 CobaltStrike

Intelligence

File Origin
# of uploads :
1
# of downloads :
489
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/114229/
Detection(s):
SecuriteInfo.com.Trojan.Encoder.31657.7773.30126.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Connection attempt
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/592880
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fbe1b7e3984d33ae5f5756116aaddce9139849cf0364f4ca1edb74d8a273e766/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-23 04:51:42 UTC
File Type:
PE+ (Exe)
Extracted files:
1411
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
06eeeac97751699903c4751be6fce5d4d453e25830e8a02cc118f41d592308c9
CobaltStrike
13af08593a4bd73dfcf9620842e8c86b24d6e30a2afe5b17aee21274eaf8a8b3
CobaltStrike
260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15
CobaltStrike
290452bb8eb4dfcc3cfb1590c8fb1b44427a3c9f0439ad5855e35bc39537a3a3
CobaltStrike
3aee007de2648d8a6c64bf1dfd6ed605bd380a22892e00b5c5d1e3643aebe71d
CobaltStrike
4ddfd623ef499cb59cd55be3a72e22acefb23488d1631692baaff001471b2bea
CobaltStrike
5f7edbfee38f8e9a93df459405b952189d48b4a7f2ddc7a81d25bdfd59b31c80
CobaltStrike
8d3c6da3f4d6513a1d38058a6cf6028e0c07210a5c0509f47150152362093636
CobaltStrike
b6bfb18cb265786cbf4373a6dc82d4b8ec586d90f6a6e2cc72a1a3d20b60dda9
CobaltStrike
e68a310f4d4a1a9d76c462cf0404a702bc138296a1badd2a7728656b3757c254
CobaltStrike
+ 15 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
pyinstaller
Link:
https://tria.ge/reports/210128-w38bp7qpja/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
JavaScript code in executable
Loads dropped DLL
Unpacked files
SH256 hash:
fbe1b7e3984d33ae5f5756116aaddce9139849cf0364f4ca1edb74d8a273e766
MD5 hash:
c5c31a6065e67a8555eb7ca0e37cfa8a
SHA1 hash:
4415f5070569af1fefdf99f2deed3477e6ff9e05
Link:
https://www.unpac.me/results/8f92e26b-71c1-4275-9aa6-aa4aa4a54436/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fbe1b7e3984d33ae5f5756116aaddce9139849cf0364f4ca1edb74d8a273e766

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_File_pyinstaller
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Description:Detect PE file produced by pyinstaller
Reference:https://isc.sans.edu/diary/21057
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/malwrhunterteam/status/1354749385041711105?s=20
Cape
Cape
https://www.capesandbox.com/analysis/114229/

Comments