cobaltstrike | 5625ea11d8f6636a4bb80f05ef1114f378dc0ada4f5a9bee63dfdba2f0d763b5 | Triage

Sharing

General

Target

5625ea11d8f6636a4bb80f05ef1114f378dc0ada4f5a9bee63dfdba2f0d763b5
Size

1.1MB
Sample

240919-j6dr1syfjd
MD5

a71b37161a2e4741502427125131b5e9
SHA1

072ee8347225ef3fc81661244f42884d4705581f
SHA256

5625ea11d8f6636a4bb80f05ef1114f378dc0ada4f5a9bee63dfdba2f0d763b5
SHA512

4a37d3843cd13289a9a068716a7af1ed5d2644f1b3868c569305c74d8ad22420cb83c77e90c3776084f406597458c7200e693733db138559a5f752e4a0462ef9
SSDEEP

12288:6FV7bVeHoFBL5hJjqT38UW5HJ/4+2V0T+ES+o3xj+bH5myRCd/UE5:6v3bjLz9x1U+j5NRd

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://39.104.52.122:8992/jquery-3.3.2.slim.min.js

Attributes

user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Targets

- Target
  
  5625ea11d8f6636a4bb80f05ef1114f378dc0ada4f5a9bee63dfdba2f0d763b5
- Size
  
  1.1MB
- MD5
  
  a71b37161a2e4741502427125131b5e9
- SHA1
  
  072ee8347225ef3fc81661244f42884d4705581f
- SHA256
  
  5625ea11d8f6636a4bb80f05ef1114f378dc0ada4f5a9bee63dfdba2f0d763b5
- SHA512
  
  4a37d3843cd13289a9a068716a7af1ed5d2644f1b3868c569305c74d8ad22420cb83c77e90c3776084f406597458c7200e693733db138559a5f752e4a0462ef9
- SSDEEP
  
  12288:6FV7bVeHoFBL5hJjqT38UW5HJ/4+2V0T+ES+o3xj+bH5myRCd/UE5:6v3bjLz9x1U+j5NRd
Score

10^/10

cobaltstrike backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

cobaltstrikebackdoortrojan