cobaltstrike | f62629540d1f5d28db07432d5b4e7843fc378b25008f6b2ebf977dc37d6446a6 | Triage

Sharing

General

Target

f62629540d1f5d28db07432d5b4e7843fc378b25008f6b2ebf977dc37d6446a6
Size

112KB
Sample

241123-py4alavmcv
MD5

31df26875f306ce305c66cfeb53b33a6
SHA1

acc46058c0980c78d4361abe0ad6190e579df9c0
SHA256

f62629540d1f5d28db07432d5b4e7843fc378b25008f6b2ebf977dc37d6446a6
SHA512

df007b68bbfdd934babd579e6d55f6469e4bc0dfd4f00a217efc4d8cf5aca48d3d17b9a364d70bc1dc4261b9798d270070481f664c7118ad03dccdf1370475ce
SSDEEP

3072:ChRWtSb0pjpbM6QiQQO4g+MxWK2o5wu1KH:aWtSb0pjpIlQO4gVxt5w3

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.137.6:80/aca8

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP08; MAAU; NP08)

Targets

- Target
  
  f62629540d1f5d28db07432d5b4e7843fc378b25008f6b2ebf977dc37d6446a6
- Size
  
  112KB
- MD5
  
  31df26875f306ce305c66cfeb53b33a6
- SHA1
  
  acc46058c0980c78d4361abe0ad6190e579df9c0
- SHA256
  
  f62629540d1f5d28db07432d5b4e7843fc378b25008f6b2ebf977dc37d6446a6
- SHA512
  
  df007b68bbfdd934babd579e6d55f6469e4bc0dfd4f00a217efc4d8cf5aca48d3d17b9a364d70bc1dc4261b9798d270070481f664c7118ad03dccdf1370475ce
- SSDEEP
  
  3072:ChRWtSb0pjpbM6QiQQO4g+MxWK2o5wu1KH:aWtSb0pjpIlQO4gVxt5w3
Score

10^/10

cobaltstrike backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Cobaltstrike family
  cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

cobaltstrikebackdoortrojan

behavioral2

cobaltstrikebackdoortrojan