cobaltstrike | c6dc434f5a6ffb122a49b029f050d21986bdbb895c6b78babe467fbe1599119a | Triage

Sharing

General

Target

MicrosoftUpdates.exe
Size

1.3MB
Sample

230324-qt154sgg2y
MD5

4f5741e9cad4108ff416cdba20ce83a3
SHA1

63076e2bf03025eef97b9b7f458771c4f1bfe095
SHA256

c6dc434f5a6ffb122a49b029f050d21986bdbb895c6b78babe467fbe1599119a
SHA512

2e8336a152df04ba9bd9cf43a5f8ee61756be329a50cf7b5831d25a50e3ad01e70422ae7a25de890b8fcea6b5af0c688a360d294a20f4c9cf6f812556118063b
SSDEEP

24576:kET6UXC5icyL3dF+NZ7frNVD2oWj20Hgl+wl:kjX5K3eVab20Hgl+w

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://www.microsoft-cdn.cf:443/understand/tips/GMY0TY2G

Attributes

user_agent
Accept: application/xml, image/*, text/html Accept-Language: ca Accept-Encoding: *, br User-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36 Host: www.microsoft-cdn.cf

Targets

- Target
  
  MicrosoftUpdates.exe
- Size
  
  1.3MB
- MD5
  
  4f5741e9cad4108ff416cdba20ce83a3
- SHA1
  
  63076e2bf03025eef97b9b7f458771c4f1bfe095
- SHA256
  
  c6dc434f5a6ffb122a49b029f050d21986bdbb895c6b78babe467fbe1599119a
- SHA512
  
  2e8336a152df04ba9bd9cf43a5f8ee61756be329a50cf7b5831d25a50e3ad01e70422ae7a25de890b8fcea6b5af0c688a360d294a20f4c9cf6f812556118063b
- SSDEEP
  
  24576:kET6UXC5icyL3dF+NZ7frNVD2oWj20Hgl+wl:kjX5K3eVab20Hgl+w
Score

10^/10

cobaltstrike backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

cobaltstrikebackdoortrojan

behavioral2

cobaltstrikebackdoortrojan