cobaltstrike | b3773c619c4e4d1c462fb6237c21271e53399ab522d2f78fb468ba2eef4f80d9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b3773c619c4e4d1c462fb6237c21271e53399ab522d2f78fb468ba2eef4f80d9
Size

140KB
Sample

221205-n5hf2aca2v
MD5

f6eb7ecc2886b0802f0861a57f2b717d
SHA1

1a1b1402eb10fcade5b23d9a44e0dfc505f4641a
SHA256

b3773c619c4e4d1c462fb6237c21271e53399ab522d2f78fb468ba2eef4f80d9
SHA512

29648e06832f5b180dbd82fa280acc4bfca3c1109a5af2fa92c5290501dea047b6e1f0bc09969a7267fb65f312d8e2a6426f6dbeb3c8498c7f4e9a03eee0069b
SSDEEP

3072:b++VMoTxyi9e7O1IXLoSWRqbLj1KIQqEkB6D:b+rotyzRXLowj1KI1EU6D

Score

10^/10

cobaltstrike backdoor persistence trojan

Malware Config

Targets

- Target
  
  b3773c619c4e4d1c462fb6237c21271e53399ab522d2f78fb468ba2eef4f80d9
- Size
  
  140KB
- MD5
  
  f6eb7ecc2886b0802f0861a57f2b717d
- SHA1
  
  1a1b1402eb10fcade5b23d9a44e0dfc505f4641a
- SHA256
  
  b3773c619c4e4d1c462fb6237c21271e53399ab522d2f78fb468ba2eef4f80d9
- SHA512
  
  29648e06832f5b180dbd82fa280acc4bfca3c1109a5af2fa92c5290501dea047b6e1f0bc09969a7267fb65f312d8e2a6426f6dbeb3c8498c7f4e9a03eee0069b
- SSDEEP
  
  3072:b++VMoTxyi9e7O1IXLoSWRqbLj1KIQqEkB6D:b+rotyzRXLowj1KI1EU6D
Score

10^/10

cobaltstrike backdoor persistence trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

cobaltstrikebackdoorpersistencetrojan

behavioral2

cobaltstrikebackdoorpersistencetrojan