cobaltstrike | a2029234f031d6fc32ba71b2fdbb90625c1847762975186927024f2e157a03d7 | Triage

Sharing

General

Target

a2029234f031d6fc32ba71b2fdbb90625c1847762975186927024f2e157a03d7.exe
Size

257KB
Sample

240519-kxkdwabc5y
MD5

57f968fccd6382e11c6761688cbb5807
SHA1

060e3a446a946d53e800d98e45261df2890c4a8f
SHA256

a2029234f031d6fc32ba71b2fdbb90625c1847762975186927024f2e157a03d7
SHA512

c70b174d2b216dd608913b14174be84e8cc942f936a80c4ade1466d2434dbfb0d1aec666470da4975b9f0f93bef695ff10f629ddea83e5897259af6167f0da12
SSDEEP

3072:Vvzu2srb4cTO3WZ3ij5rjjixcaZ+/9+2r0Ubmphk+3T+plbR:42aXZ+rjLQ2FYk+36LF

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://150.158.150.214:443/jquery-3.3.2.slim.min.js

Attributes

user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.130 Safari/537.36

Targets

- Target
  
  a2029234f031d6fc32ba71b2fdbb90625c1847762975186927024f2e157a03d7.exe
- Size
  
  257KB
- MD5
  
  57f968fccd6382e11c6761688cbb5807
- SHA1
  
  060e3a446a946d53e800d98e45261df2890c4a8f
- SHA256
  
  a2029234f031d6fc32ba71b2fdbb90625c1847762975186927024f2e157a03d7
- SHA512
  
  c70b174d2b216dd608913b14174be84e8cc942f936a80c4ade1466d2434dbfb0d1aec666470da4975b9f0f93bef695ff10f629ddea83e5897259af6167f0da12
- SSDEEP
  
  3072:Vvzu2srb4cTO3WZ3ij5rjjixcaZ+/9+2r0Ubmphk+3T+plbR:42aXZ+rjLQ2FYk+36LF
Score

10^/10

cobaltstrike backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

cobaltstrikebackdoortrojan