cobaltstrike | 8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82 | Triage

Sharing

General

Target

8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82
Size

6.1MB
Sample

240812-lb74gsyfqc
MD5

fdf7978c3aed9fe50f818eea32c2d6e1
SHA1

06c1d9b55ebf9853f9ad26bea88036ff9b3c8c4f
SHA256

8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82
SHA512

d65b682bedde89864228d05e754e2dc040e778750a5fa35bb119b8ae569c67ad90588350477109c5428568d3ab0bc8a24e0954b7268acb6597b88b8a333ace23
SSDEEP

196608:XNFO9onJ5hrZERkB2WZufOuD9L7CTUKytL0p:dFO9c5hlERA2WmfDZccLw

Score

10^/10

cobaltstrike backdoor pyinstaller trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.15.23:80/mt_show_1.8.js

Attributes

user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://2aede.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Targets

- Target
  
  8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82
- Size
  
  6.1MB
- MD5
  
  fdf7978c3aed9fe50f818eea32c2d6e1
- SHA1
  
  06c1d9b55ebf9853f9ad26bea88036ff9b3c8c4f
- SHA256
  
  8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82
- SHA512
  
  d65b682bedde89864228d05e754e2dc040e778750a5fa35bb119b8ae569c67ad90588350477109c5428568d3ab0bc8a24e0954b7268acb6597b88b8a333ace23
- SSDEEP
  
  196608:XNFO9onJ5hrZERkB2WZufOuD9L7CTUKytL0p:dFO9c5hlERA2WmfDZccLw
Score

10^/10

cobaltstrike backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

pyinstallercobaltstrike

behavioral1

cobaltstrikebackdoortrojan

behavioral2

cobaltstrikebackdoortrojan