cobaltstrike | 285c5479be1bb8e40cca124ccc9f281d92bee2b7cd9b7e9d0fb0b1a774f5db44 | Triage

Sharing

General

Target

285c5479be1bb8e40cca124ccc9f281d92bee2b7cd9b7e9d0fb0b1a774f5db44
Size

19KB
Sample

240519-3a2czsgf3s
MD5

cb560e294ed5f5e852e0155034120394
SHA1

503a9703d38eef1f5a259ce0b0f711808a16c62e
SHA256

285c5479be1bb8e40cca124ccc9f281d92bee2b7cd9b7e9d0fb0b1a774f5db44
SHA512

a721b7ff7350f78dbc5a66f37f6081fadcc9dc71b8a86489a3846fa70a63afe1ad7a404f72199d25020246affc9b2f1ed6262ba587702b08279ee5d6d684e6cd
SSDEEP

192:kV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2DMxVWF8qa1Dojjgi:WqaCF31cix+Dc4zjCMSFF46gi

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.71.128:5656/joM7

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSMSE)

Targets

- Target
  
  285c5479be1bb8e40cca124ccc9f281d92bee2b7cd9b7e9d0fb0b1a774f5db44
- Size
  
  19KB
- MD5
  
  cb560e294ed5f5e852e0155034120394
- SHA1
  
  503a9703d38eef1f5a259ce0b0f711808a16c62e
- SHA256
  
  285c5479be1bb8e40cca124ccc9f281d92bee2b7cd9b7e9d0fb0b1a774f5db44
- SHA512
  
  a721b7ff7350f78dbc5a66f37f6081fadcc9dc71b8a86489a3846fa70a63afe1ad7a404f72199d25020246affc9b2f1ed6262ba587702b08279ee5d6d684e6cd
- SSDEEP
  
  192:kV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2DMxVWF8qa1Dojjgi:WqaCF31cix+Dc4zjCMSFF46gi
Score

10^/10

cobaltstrike backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

cobaltstrikebackdoortrojan

behavioral2

cobaltstrikebackdoortrojan