cobaltstrike | 6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb
Size

22KB
Sample

231013-3d1wmaeh4z
MD5

613b1a268d2e7c4d1721de88fdabb036
SHA1

e5421231ac4ebb55ae475f52076d28ab6de5111a
SHA256

6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb
SHA512

8f0a27ed86e252aa91408056b3a8966151eb8b40218c5f2b89198bc975da40f7c2e09a7d37609f06749b24d455db6ffd7faaf7a44f3f2c62aca3e25d14aefae6
SSDEEP

384:FjSfrjscTsBJryaa0jn8w1EUtwzVueHwKM5BZMsrgZdUSz3/Yc/PC:te3rFAjnNtEuwk5rgZzL/Yc/PC

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://150.158.194.26:18443/CDcs

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET4.0C; .NET4.0E)

Targets

- Target
  
  6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb
- Size
  
  22KB
- MD5
  
  613b1a268d2e7c4d1721de88fdabb036
- SHA1
  
  e5421231ac4ebb55ae475f52076d28ab6de5111a
- SHA256
  
  6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb
- SHA512
  
  8f0a27ed86e252aa91408056b3a8966151eb8b40218c5f2b89198bc975da40f7c2e09a7d37609f06749b24d455db6ffd7faaf7a44f3f2c62aca3e25d14aefae6
- SSDEEP
  
  384:FjSfrjscTsBJryaa0jn8w1EUtwzVueHwKM5BZMsrgZdUSz3/Yc/PC:te3rFAjnNtEuwk5rgZzL/Yc/PC
Score

10^/10

cobaltstrike backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

cobaltstrikebackdoortrojan

behavioral2

cobaltstrikebackdoortrojan