cobaltstrike | d99bd70608f19276b50d3c3c3160cb34fdecf97bc2a35c8ce7c33c1f9b7109bc | Triage

Sharing

General

Target

d99bd70608f19276b50d3c3c3160cb34fdecf97bc2a35c8ce7c33c1f9b7109bc
Size

142KB
Sample

221129-17cd1sfh8z
MD5

54f33e6050b8b5d7f2d705f5abb910e0
SHA1

da3ecb547f78b74c22e0861f8c6cb2c04bb69dd0
SHA256

d99bd70608f19276b50d3c3c3160cb34fdecf97bc2a35c8ce7c33c1f9b7109bc
SHA512

3a560fc1296092f2ec78945f2e97d62712906fc03a7d0c6927bb3d0c1b6480d2d0615f6b091da706cedb4d15c3342541d9e3ed2c73102d544f03cf5397e7330c
SSDEEP

1536:7++fq6M5b9NqTxV67wAInyAeG+90MHJaOsp1gMIEELZ2G6CNgRtOOOOOOOOEQ6zP:7++VMoTxyi9e7O1IXLoSWRqd6UyR

Score

10^/10

cobaltstrike backdoor persistence trojan

Malware Config

Targets

- Target
  
  d99bd70608f19276b50d3c3c3160cb34fdecf97bc2a35c8ce7c33c1f9b7109bc
- Size
  
  142KB
- MD5
  
  54f33e6050b8b5d7f2d705f5abb910e0
- SHA1
  
  da3ecb547f78b74c22e0861f8c6cb2c04bb69dd0
- SHA256
  
  d99bd70608f19276b50d3c3c3160cb34fdecf97bc2a35c8ce7c33c1f9b7109bc
- SHA512
  
  3a560fc1296092f2ec78945f2e97d62712906fc03a7d0c6927bb3d0c1b6480d2d0615f6b091da706cedb4d15c3342541d9e3ed2c73102d544f03cf5397e7330c
- SSDEEP
  
  1536:7++fq6M5b9NqTxV67wAInyAeG+90MHJaOsp1gMIEELZ2G6CNgRtOOOOOOOOEQ6zP:7++VMoTxyi9e7O1IXLoSWRqd6UyR
Score

10^/10

cobaltstrike backdoor persistence trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

cobaltstrikebackdoorpersistencetrojan

behavioral2

cobaltstrikebackdoorpersistencetrojan