cobaltstrike | 9d5d1b2c713498f00c4768046a7c42dce42713ee7d8eb5c2145dcd178d348edc | Triage

Sharing

General

Target

RCSInstall.exe.virus
Size

1.2MB
Sample

240520-kk796sca42
MD5

b9f122088ef2a9781beb4f8258685086
SHA1

6291ad582a9c917a6064a7aa5f7d62da2bb5ee4c
SHA256

9d5d1b2c713498f00c4768046a7c42dce42713ee7d8eb5c2145dcd178d348edc
SHA512

eeb23ca6d45e99bc6fcfae71bd82af0aeb56825e3dee243ce6c2fbd1601b156f1b1d4f537466acb9d1e614a898541729bbcb47198db0a93adb7e73dbe39db6b6
SSDEEP

12288:K/p9Rjmu9Rdix/3qngsgR8mGNoZDxIogIKQiBKF0tYtQadWM:KllRdix/eOGiDTGvgmqndWM

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://101.35.246.111:443/jquery-3.3.2.slim.min.js

Attributes

user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.130 Safari/537.36

Targets

- Target
  
  RCSInstall.exe.virus
- Size
  
  1.2MB
- MD5
  
  b9f122088ef2a9781beb4f8258685086
- SHA1
  
  6291ad582a9c917a6064a7aa5f7d62da2bb5ee4c
- SHA256
  
  9d5d1b2c713498f00c4768046a7c42dce42713ee7d8eb5c2145dcd178d348edc
- SHA512
  
  eeb23ca6d45e99bc6fcfae71bd82af0aeb56825e3dee243ce6c2fbd1601b156f1b1d4f537466acb9d1e614a898541729bbcb47198db0a93adb7e73dbe39db6b6
- SSDEEP
  
  12288:K/p9Rjmu9Rdix/3qngsgR8mGNoZDxIogIKQiBKF0tYtQadWM:KllRdix/eOGiDTGvgmqndWM
Score

10^/10

cobaltstrike backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

cobaltstrikebackdoortrojan

behavioral2