MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc4c45524b459ee65fff5e9bc484cb1209cf89cff5e9e5a534d439533a95ceed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc4c45524b459ee65fff5e9bc484cb1209cf89cff5e9e5a534d439533a95ceed
SHA3-384 hash: 701b0812c84103d8d70d1c2a037258dde7707e7a50ef31f588e065beccacc3f38236b84ea53a3b3ef3d795737e15112d
SHA1 hash: d0c22d0277cea08f176d3b0e0cb030947e21851c
MD5 hash: 6b6ebf1923001878daa1fbf09640655c
humanhash: speaker-yankee-tennis-apart
File name:other.exe
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:224'768 bytes
First seen:2020-09-20 19:18:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 829da329ce140d873b4a8bde2cbfaa7e (259 x CobaltStrike)
ssdeep 6144:8m168FmCFsPeN8fdoIg4j5T0MJHYV1o6ckOnNyjtnlQ:8iwvmN8fKl4j5AMJ13k+NulQ
Threatray 73 similar samples on MalwareBazaar
TLSH 5D24CDBC24A5D6A7FA49F6BC9E9816E51DE3F8738E246C11AF23D98332923DF4C05141
Reporter James_inthe_box
Tags:CobaltStrike exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Detection:
CobaltStrikeBeacon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/63917/
Detection(s):
SecuriteInfo.com.Crypt5.BLLV.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/470908
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fc4c45524b459ee65fff5e9bc484cb1209cf89cff5e9e5a534d439533a95ceed/
Threat name:
Win32.Trojan.Rozena
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 22:19:00 UTC
File Type:
PE (Exe)
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7rgekusliwpomx77l2n4jbglcie47cop6xu6ljju2q4vgouvz3wq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
4d8232c8973ec2c528be5f380b9f027a7221023e2b2e774403a8839385b2e197
CobaltStrike
514de96ef99941a0c9712622848b687b402b0635a4bb45cf1cee0002fe8cdfcd
CobaltStrike
580cc9e785ffa316f63b39365e7f21a570404fd833046d09e5e132aadde7a4ba
CobaltStrike
5e81e0f0aa8ff34a845b62472a3d2a83fa43ee47819dbc841d8004b64ffd79fc
CobaltStrike
65b353273d5aa143b6ad5fc5ee4af51930ccef9ea96d07345a619f8950d1132d
CobaltStrike
70e96ab0deb629da68b0af277376f4598c1062064beecedf3ee8d72de0a9b1a1
CobaltStrike
e050425e51b6c04333e0b93b6a9e30b454adec91161e010f24c2b2b7be451279
CobaltStrike
e05f6dab54210a041235191663afd7f296c4733e42d9f09b971a9861bf317df8
CobaltStrike
ec80dafae2b435962d141d4137ba9e9b84d36c5933828c490d113a88b9c4d2a5
CobaltStrike
fb01851fc2be012833865bd37f81fa98f6a27131bb660e5b01c5eedb8070ceab
CobaltStrike
+ 63 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
trojan backdoor family:cobaltstrike
Link:
https://tria.ge/reports/200920-nv1e64hqgx/
Behaviour
Cobaltstrike
Malware Config
C2 Extraction:
http://103.140.238.125:443/directory/all/tags/dcf598ca-b5de-47d4-af33-ecabe9eaeee1
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
CobaltStrike
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fc4c45524b459ee65fff5e9bc484cb1209cf89cff5e9e5a534d439533a95ceed

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_DarkHydrus_Jul18_5
Create hunting rule
Author:Florian Roth
Description:Detects strings found in malware samples in APT report in DarkHydrus
Reference:https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/63917/

Comments