cobaltstrike | cb01f31a322572035cf19f6cda00bcf1d8235dcc692588810405d0fc6e8d239c | Triage

Sharing

General

Target

efc4c153206e06fd43d07496e0be502c_JaffaCakes118
Size

152KB
Sample

240921-pd3hka1fnb
MD5

efc4c153206e06fd43d07496e0be502c
SHA1

b9b1239f89981e09c1f8d333e6631bf43386fe28
SHA256

cb01f31a322572035cf19f6cda00bcf1d8235dcc692588810405d0fc6e8d239c
SHA512

2d03f35758e5b853a8772a109738d9464955681b3f28d2b438510f393db109aa24d7a76d8875801687c1060811bc62ac03221d11992c3bb2792443aa78f700a3
SSDEEP

3072:krW1+PlAoE3DqKQevDXHoX6zr/YRr4FfNW9KWGeQ15aH:fWpETNQevzIX6zWreeQ1g

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://hdhuge.com:443/files/remove.gif

Attributes

user_agent
Host: amazon.co.jp Connection: close Accept: image/jpeg User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246

Targets

- Target
  
  efc4c153206e06fd43d07496e0be502c_JaffaCakes118
- Size
  
  152KB
- MD5
  
  efc4c153206e06fd43d07496e0be502c
- SHA1
  
  b9b1239f89981e09c1f8d333e6631bf43386fe28
- SHA256
  
  cb01f31a322572035cf19f6cda00bcf1d8235dcc692588810405d0fc6e8d239c
- SHA512
  
  2d03f35758e5b853a8772a109738d9464955681b3f28d2b438510f393db109aa24d7a76d8875801687c1060811bc62ac03221d11992c3bb2792443aa78f700a3
- SSDEEP
  
  3072:krW1+PlAoE3DqKQevDXHoX6zr/YRr4FfNW9KWGeQ15aH:fWpETNQevzIX6zWreeQ1g
Score

10^/10

cobaltstrike backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

cobaltstrikebackdoortrojan

behavioral2

cobaltstrikebackdoortrojan