cobaltstrike | c5d039460ace0ce81ca3fe8ae2cd1fbbcaab48e7f4fd375bf87c077d9500954c | Triage

Sharing

General

Target

c5d039460ace0ce81ca3fe8ae2cd1fbbcaab48e7f4fd375bf87c077d9500954c
Size

12KB
Sample

240926-yj8q7svekp
MD5

000ac6da3b0dcc75079f8cd62b29b05a
SHA1

f45fb3a198a61196d824fc747a66dd7c7cc2703b
SHA256

c5d039460ace0ce81ca3fe8ae2cd1fbbcaab48e7f4fd375bf87c077d9500954c
SHA512

34d757d176af3daa39a49b9736a589dfabef959632368d0d3d9c0dd3de863d6a19ae8f80ff33165acae7cda06841d2311ee0bc5c5d71439e34cc6bb4cbbf00eb
SSDEEP

192:gHITdiTedWSiDXxuJNvcum0+TRH+NGvyHNpsQ5tfBDm23:gBRDXMqTBEWytpst2

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://www.bilibli.mom:443/jquery-3.3.2.slim.min.js

Attributes

user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.bilibli.mom Referer: http://www.bilibli.mom/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Targets

- Target
  
  c5d039460ace0ce81ca3fe8ae2cd1fbbcaab48e7f4fd375bf87c077d9500954c
- Size
  
  12KB
- MD5
  
  000ac6da3b0dcc75079f8cd62b29b05a
- SHA1
  
  f45fb3a198a61196d824fc747a66dd7c7cc2703b
- SHA256
  
  c5d039460ace0ce81ca3fe8ae2cd1fbbcaab48e7f4fd375bf87c077d9500954c
- SHA512
  
  34d757d176af3daa39a49b9736a589dfabef959632368d0d3d9c0dd3de863d6a19ae8f80ff33165acae7cda06841d2311ee0bc5c5d71439e34cc6bb4cbbf00eb
- SSDEEP
  
  192:gHITdiTedWSiDXxuJNvcum0+TRH+NGvyHNpsQ5tfBDm23:gBRDXMqTBEWytpst2
Score

10^/10

cobaltstrike backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

cobaltstrikebackdoortrojan