cobaltstrike | 8c3d6b00f5bbb2fad314b78fd437dd3427ed83a7cbdff6394f46d9b0e344266d | Triage

Sharing

General

Target

8c3d6b00f5bbb2fad314b78fd437dd3427ed83a7cbdff6394f46d9b0e344266d
Size

215KB
Sample

221125-1ja62sbg81
MD5

c8db1b52e171aa0364bb82bd6977ab3d
SHA1

d439a2954b7961d88e57a09ed7a0f986b04d2107
SHA256

8c3d6b00f5bbb2fad314b78fd437dd3427ed83a7cbdff6394f46d9b0e344266d
SHA512

7311dc574195d52e6d1c686405744a08cd47917fc4fb5a2b163918af353966f68319453e5c341078cc68c830b6bd26534a2fa532a7c8729070538579a40c286c
SSDEEP

1536:uvIC6+gLE5QLPoSVyRy7QVgfSyrMSglKcN5RkysdxEJPk7hy97Y6UESbMonA+:lC/gLTTyRy7LfS2glhRXJehyBJUEoJA+

Score

10^/10

cobaltstrike backdoor persistence trojan

Malware Config

Targets

- Target
  
  8c3d6b00f5bbb2fad314b78fd437dd3427ed83a7cbdff6394f46d9b0e344266d
- Size
  
  215KB
- MD5
  
  c8db1b52e171aa0364bb82bd6977ab3d
- SHA1
  
  d439a2954b7961d88e57a09ed7a0f986b04d2107
- SHA256
  
  8c3d6b00f5bbb2fad314b78fd437dd3427ed83a7cbdff6394f46d9b0e344266d
- SHA512
  
  7311dc574195d52e6d1c686405744a08cd47917fc4fb5a2b163918af353966f68319453e5c341078cc68c830b6bd26534a2fa532a7c8729070538579a40c286c
- SSDEEP
  
  1536:uvIC6+gLE5QLPoSVyRy7QVgfSyrMSglKcN5RkysdxEJPk7hy97Y6UESbMonA+:lC/gLTTyRy7LfS2glhRXJehyBJUEoJA+
Score

10^/10

cobaltstrike backdoor persistence trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

cobaltstrikebackdoorpersistencetrojan

behavioral2

cobaltstrikebackdoorpersistencetrojan