cobaltstrike | 8f81fa9b717b7314e270a36c883549d3aaa5c68907e1056b5de1989bf3fbffd6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8f81fa9b717b7314e270a36c883549d3aaa5c68907e1056b5de1989bf3fbffd6
Size

972KB
Sample

240225-jgvdgaff7y
MD5

61d0f7a8ed63c7a3cb0c0afba6551db0
SHA1

4da2b192b133d844762978f0afddb978fa3c3b7c
SHA256

8f81fa9b717b7314e270a36c883549d3aaa5c68907e1056b5de1989bf3fbffd6
SHA512

2bf14039a877297fd0b47da03ba74717ca0984fdef3bb909105ab677277dac02cea4139773279316f898a0cfe4a6a2081737644f151ae44e10baf8249e91fe1a
SSDEEP

12288:K6j8MdyxsNFeo0ykfQdvcRcsFVEE6Pa9xMzK3gVhTNDAvT7ItBR:8M8x2EZfQdvcRtDNgVhTePItB

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://update.office-oa.org:8443/api/2

Attributes

user_agent
Host: update.office-oa.org User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

Targets

- Target
  
  8f81fa9b717b7314e270a36c883549d3aaa5c68907e1056b5de1989bf3fbffd6
- Size
  
  972KB
- MD5
  
  61d0f7a8ed63c7a3cb0c0afba6551db0
- SHA1
  
  4da2b192b133d844762978f0afddb978fa3c3b7c
- SHA256
  
  8f81fa9b717b7314e270a36c883549d3aaa5c68907e1056b5de1989bf3fbffd6
- SHA512
  
  2bf14039a877297fd0b47da03ba74717ca0984fdef3bb909105ab677277dac02cea4139773279316f898a0cfe4a6a2081737644f151ae44e10baf8249e91fe1a
- SSDEEP
  
  12288:K6j8MdyxsNFeo0ykfQdvcRcsFVEE6Pa9xMzK3gVhTNDAvT7ItBR:8M8x2EZfQdvcRtDNgVhTePItB
Score

10^/10

cobaltstrike backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

cobaltstrikebackdoortrojan

behavioral2

cobaltstrikebackdoortrojan