cobaltstrike | c2965ab6896477cde4327af7d83dc4cb25c4cf395ea58623d5c164d0037b59c7 | Triage

Sharing

General

Target

c2965ab6896477cde4327af7d83dc4cb25c4cf395ea58623d5c164d0037b59c7
Size

1.8MB
Sample

240518-crd1xaff71
MD5

96580752745af11800aea1d54d6aea89
SHA1

1116fa527801232edace6b139d7c5c861d86dd65
SHA256

c2965ab6896477cde4327af7d83dc4cb25c4cf395ea58623d5c164d0037b59c7
SHA512

123b5632865f1a48d695ffdbd33a17ed5b3653ce55366db9c60abd9c30123e851be8719e838d673bf6f9227fce5766c231203fc66b33a01c02a38d86ceebded3
SSDEEP

24576:EiOKAoxqKzaxVAb7NTCPjm7LgFJjb5n8Be8ccW:WKjxqKzasXUjZrn6Zcc

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://101.35.245.191:443/jquery-3.3.2.slim.min.js

Attributes

user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Targets

- Target
  
  c2965ab6896477cde4327af7d83dc4cb25c4cf395ea58623d5c164d0037b59c7
- Size
  
  1.8MB
- MD5
  
  96580752745af11800aea1d54d6aea89
- SHA1
  
  1116fa527801232edace6b139d7c5c861d86dd65
- SHA256
  
  c2965ab6896477cde4327af7d83dc4cb25c4cf395ea58623d5c164d0037b59c7
- SHA512
  
  123b5632865f1a48d695ffdbd33a17ed5b3653ce55366db9c60abd9c30123e851be8719e838d673bf6f9227fce5766c231203fc66b33a01c02a38d86ceebded3
- SSDEEP
  
  24576:EiOKAoxqKzaxVAb7NTCPjm7LgFJjb5n8Be8ccW:WKjxqKzasXUjZrn6Zcc
Score

10^/10

cobaltstrike backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

cobaltstrikebackdoortrojan