cobaltstrike | 019e7b25179b43401396536ac8c3923893def59608c05154e132db38108b1925 | Triage

Sharing

General

Target

019e7b25179b43401396536ac8c3923893def59608c05154e132db38108b1925
Size

9.2MB
Sample

240926-knx9daxerq
MD5

5af92b1d8eed1285c0f3225d54e15d98
SHA1

d8d2174a4de3cb7f7603d7201b7ebd8ba8034355
SHA256

019e7b25179b43401396536ac8c3923893def59608c05154e132db38108b1925
SHA512

e0a503f5f4e97ddc52e1e71ecebc276944fa48bdfaffc15133f7a34dd30d074217c02efc50e65294336601584d7ccc85a8f6f2a4534f33f7223011accffcdca8
SSDEEP

196608:N6EkbzeIXVhKB9onJ5hrZERQyiU8AdZYJERH2rTcDPC3TKqbhB5:YEkbbXVM9c5hlER8AdZYyQrwDPe

Score

10^/10

cobaltstrike backdoor pyinstaller trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://47.95.196.132:27430/NsZB

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP06)

Targets

- Target
  
  019e7b25179b43401396536ac8c3923893def59608c05154e132db38108b1925
- Size
  
  9.2MB
- MD5
  
  5af92b1d8eed1285c0f3225d54e15d98
- SHA1
  
  d8d2174a4de3cb7f7603d7201b7ebd8ba8034355
- SHA256
  
  019e7b25179b43401396536ac8c3923893def59608c05154e132db38108b1925
- SHA512
  
  e0a503f5f4e97ddc52e1e71ecebc276944fa48bdfaffc15133f7a34dd30d074217c02efc50e65294336601584d7ccc85a8f6f2a4534f33f7223011accffcdca8
- SSDEEP
  
  196608:N6EkbzeIXVhKB9onJ5hrZERQyiU8AdZYJERH2rTcDPC3TKqbhB5:YEkbbXVM9c5hlER8AdZYyQrwDPe
Score

10^/10

cobaltstrike backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

cobaltstrikebackdoortrojan