cobaltstrike | 030405f03e9152882d7a480cd4af1ae1e60ab5e10a010c4ac98bad7d8b9c05b4 | Triage

Sharing

General

Target

2024-09-10_40d889427c3db5dcf479378dcac954c9_cobalt-strike_ryuk
Size

951KB
Sample

240910-eellbsxbqc
MD5

40d889427c3db5dcf479378dcac954c9
SHA1

e60fe132d8ddffd242f794b3ebbe2f8ab04824ff
SHA256

030405f03e9152882d7a480cd4af1ae1e60ab5e10a010c4ac98bad7d8b9c05b4
SHA512

97f2b968621647ca5de8ff99e321f8a3620a808e6b5af0085274a53ec1bbc6310ee7808e4b4f4d831bb18a7c3e78c8fd242f9aa9a276a5d3ac9070f32d7ed862
SSDEEP

12288:4QwwPAuxstPiXhK3WX89QLkTtgoYfZFV8BxNDCDZc5bP+MZQFVFmh/Z/4ANyB0:4QKuxst/3WugoBNGD9MaNB

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://124.222.72.51:4433/fl9R

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; FunWebProducts; IE0006_ver1;EN_GB)

Targets

- Target
  
  2024-09-10_40d889427c3db5dcf479378dcac954c9_cobalt-strike_ryuk
- Size
  
  951KB
- MD5
  
  40d889427c3db5dcf479378dcac954c9
- SHA1
  
  e60fe132d8ddffd242f794b3ebbe2f8ab04824ff
- SHA256
  
  030405f03e9152882d7a480cd4af1ae1e60ab5e10a010c4ac98bad7d8b9c05b4
- SHA512
  
  97f2b968621647ca5de8ff99e321f8a3620a808e6b5af0085274a53ec1bbc6310ee7808e4b4f4d831bb18a7c3e78c8fd242f9aa9a276a5d3ac9070f32d7ed862
- SSDEEP
  
  12288:4QwwPAuxstPiXhK3WX89QLkTtgoYfZFV8BxNDCDZc5bP+MZQFVFmh/Z/4ANyB0:4QKuxst/3WugoBNGD9MaNB
Score

10^/10

cobaltstrike backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

cobaltstrikebackdoortrojan