cobaltstrike | bf271c7f79b2cf0421293dddd7203731a777993836a33049be022442113949df | Triage

Sharing

General

Target

bf271c7f79b2cf0421293dddd7203731a777993836a33049be022442113949df
Size

307KB
Sample

221203-gqvpgsaf83
MD5

a1e70a0976f138b0921423530aedf190
SHA1

c92178348e4afcf021b4e845d060e3a89f9bfc29
SHA256

bf271c7f79b2cf0421293dddd7203731a777993836a33049be022442113949df
SHA512

ed89183d1f504a931f46d115d5d33aa119e436a9ede5b8b317b07307c27f6feb4929b57b18911949c59d674d3e8a79e17c35a413f003abae786f85e19f30d5b8
SSDEEP

6144:K0vzRT72Y0SszinYKTY1SQshfRPVQe1MZkIYSccr7wbstOOPECYeixlYGicB:K0bt7SSPYsY1UMqMZJYSN7wbstOO8fvf

Score

10^/10

cobaltstrike backdoor persistence trojan

Malware Config

Targets

- Target
  
  bf271c7f79b2cf0421293dddd7203731a777993836a33049be022442113949df
- Size
  
  307KB
- MD5
  
  a1e70a0976f138b0921423530aedf190
- SHA1
  
  c92178348e4afcf021b4e845d060e3a89f9bfc29
- SHA256
  
  bf271c7f79b2cf0421293dddd7203731a777993836a33049be022442113949df
- SHA512
  
  ed89183d1f504a931f46d115d5d33aa119e436a9ede5b8b317b07307c27f6feb4929b57b18911949c59d674d3e8a79e17c35a413f003abae786f85e19f30d5b8
- SSDEEP
  
  6144:K0vzRT72Y0SszinYKTY1SQshfRPVQe1MZkIYSccr7wbstOOPECYeixlYGicB:K0bt7SSPYsY1UMqMZJYSN7wbstOO8fvf
Score

10^/10

cobaltstrike backdoor persistence trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

cobaltstrikebackdoorpersistencetrojan

behavioral2

cobaltstrikebackdoortrojan