cobaltstrike | 70a1e9d0cc1216350ce6ba96619dac2f672a1886fb69f51d41c5d6aef713f83f | Triage

Sharing

General

Target

70a1e9d0cc1216350ce6ba96619dac2f672a1886fb69f51d41c5d6aef713f83f
Size

40KB
Sample

241118-rb643syclr
MD5

83b4a76392d375e8879f4b4de6991c82
SHA1

f3d7f281ae07d74111b7586382de948d86d6b3eb
SHA256

70a1e9d0cc1216350ce6ba96619dac2f672a1886fb69f51d41c5d6aef713f83f
SHA512

7824aa26399b87b3ef38e4991d5ccd608fef728a0c3f726c15805c5f2247d47806aee802bcb5cd57bccea079e8ffc04845d663c5aa8636f7cd5db94e8b1d0540
SSDEEP

384:QvfxvntmHM5t44d/o8dLiwDH6yEIMwPhcqvFfBuD215Pfa:if5tlf44d/omVPEIFhVfBuDQfa

Score

10^/10

cobaltstrike backdoor discovery trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.43.141:1111/HnRU

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; WOW64; Trident/5.0)

Targets

- Target
  
  70a1e9d0cc1216350ce6ba96619dac2f672a1886fb69f51d41c5d6aef713f83f
- Size
  
  40KB
- MD5
  
  83b4a76392d375e8879f4b4de6991c82
- SHA1
  
  f3d7f281ae07d74111b7586382de948d86d6b3eb
- SHA256
  
  70a1e9d0cc1216350ce6ba96619dac2f672a1886fb69f51d41c5d6aef713f83f
- SHA512
  
  7824aa26399b87b3ef38e4991d5ccd608fef728a0c3f726c15805c5f2247d47806aee802bcb5cd57bccea079e8ffc04845d663c5aa8636f7cd5db94e8b1d0540
- SSDEEP
  
  384:QvfxvntmHM5t44d/o8dLiwDH6yEIMwPhcqvFfBuD215Pfa:if5tlf44d/omVPEIFhVfBuDQfa
Score

10^/10

cobaltstrike backdoor trojan discovery
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Cobaltstrike family
  cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

cobaltstrikebackdoortrojan

behavioral2

cobaltstrikebackdoordiscoverytrojan