Extracted

• • Target

    0f42d6ba815739d16f265c678f7798865117ae2ee048107cc3859a60956fd87e

  • Size

    13KB

  • MD5

    7c0e7659be1c8c378a4da4ebb8eec6c4

  • SHA1

    f04dc754d52b621e5a4772d4a18b6aa3c1d089ab

  • SHA256

    0f42d6ba815739d16f265c678f7798865117ae2ee048107cc3859a60956fd87e

  • SHA512

    c497b65a820706e4bb3f748ea761ad737fd2644852e9603e18319fcc6073514114fc1864dda779d4a63bdabb4e7536c6796a77f64893b83b156bfcd53a2f745c

  • SSDEEP

    192:dYFdShBgR1Te4q0FXLl0h8Zswne3Q5tffoWR:OFdSYR1H3XLX6D36R

  Score

  10^/10

  cobaltstrikebackdoortrojanpersistence

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2