Overview

overview

10

Static

static

10

dc59a99152...fe.exe

windows7_x64

10

dc59a99152...fe.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe

  • Size

    2.5MB

  • Sample

    220708-j4zxgaahd5

  • MD5

    b70608c6a2c35914470fba5b0b91cd61

  • SHA1

    43820909b30fac5c57ee4cf38790e7af75cdb18c

  • SHA256

    dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe

  • SHA512

    d5ef559ab8a85b76b3d2e0e32bc28dacea6136a9de405b612c601a9d7769dbe7955831ae96bf9216a8bf13cbad01c96239b8958cc6f7bd0045e9f519e95fdf0a

Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://139.196.112.7:80/l2xG

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38

Targets

    • Target

      dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe

    • Size

      2.5MB

    • MD5

      b70608c6a2c35914470fba5b0b91cd61

    • SHA1

      43820909b30fac5c57ee4cf38790e7af75cdb18c

    • SHA256

      dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe

    • SHA512

      d5ef559ab8a85b76b3d2e0e32bc28dacea6136a9de405b612c601a9d7769dbe7955831ae96bf9216a8bf13cbad01c96239b8958cc6f7bd0045e9f519e95fdf0a

    Score
    10/10
    cobaltstrikebackdoortrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks