cobaltstrike | 763a97aa89a113f26796387902ab84c2869d34f8540df6b9903fa4ff13ea7795 | Triage

Sharing

General

Target

763a97aa89a113f26796387902ab84c2869d34f8540df6b9903fa4ff13ea7795
Size

401KB
Sample

240912-elercszgqa
MD5

cd48a515de812940978c15ff520b8b43
SHA1

ca0cfbb01d8ad8a4df2b9ce8c1f01eaab235bbd8
SHA256

763a97aa89a113f26796387902ab84c2869d34f8540df6b9903fa4ff13ea7795
SHA512

060735abec934f3148aa94f341a924cc47577455147050a66bb252dff68385b5311190a07deef5c6d967a6197058a1a30a6c2eaa13e4f49d39816e07853d3649
SSDEEP

6144:B39Ugho6Qu9a1QJSs416UfBYN9lo4Btd4:B32guu9aYUfBYNJBtd4

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.124.231:443/jquery-3.3.2.slim.min.js

Attributes

user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Targets

- Target
  
  763a97aa89a113f26796387902ab84c2869d34f8540df6b9903fa4ff13ea7795
- Size
  
  401KB
- MD5
  
  cd48a515de812940978c15ff520b8b43
- SHA1
  
  ca0cfbb01d8ad8a4df2b9ce8c1f01eaab235bbd8
- SHA256
  
  763a97aa89a113f26796387902ab84c2869d34f8540df6b9903fa4ff13ea7795
- SHA512
  
  060735abec934f3148aa94f341a924cc47577455147050a66bb252dff68385b5311190a07deef5c6d967a6197058a1a30a6c2eaa13e4f49d39816e07853d3649
- SSDEEP
  
  6144:B39Ugho6Qu9a1QJSs416UfBYN9lo4Btd4:B32guu9aYUfBYNJBtd4
Score

10^/10

cobaltstrike backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

cobaltstrikebackdoortrojan