cobaltstrike | 947b389e989ad941ea4f45b29b29f5df1b3eff4d05cdcc970d8982669e627626 | Triage

Sharing

General

Target

947b389e989ad941ea4f45b29b29f5df1b3eff4d05cdcc970d8982669e627626
Size

1.8MB
Sample

241214-cpejnavkep
MD5

21aee823633e17b7fbe3af8c5b49f2a1
SHA1

35d196273009ac0aab174662bde3af12cbaf595c
SHA256

947b389e989ad941ea4f45b29b29f5df1b3eff4d05cdcc970d8982669e627626
SHA512

a54639bccce7657f4db07cbbfca5492c761464397d5ed847cdf1d2e23aea6ade1050ca094c364a464a5255bae57412a3340d701e799363471ab0b2e29a76e787
SSDEEP

24576:WlNAsrR4Ao6JJChxd8JqgrmejTBdPR0cdk1nVtGnd:WlN54A3bCF0qsjMnVyd

Score

10^/10

cobaltstrike 0 backdoor discovery trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://206.206.76.193:10010/uf8J

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)

Extracted

Family

cobaltstrike

Botnet

0

C2

http://206.206.76.193:10010/dot.gif

Attributes

watermark
0

Targets

- Target
  
  947b389e989ad941ea4f45b29b29f5df1b3eff4d05cdcc970d8982669e627626
- Size
  
  1.8MB
- MD5
  
  21aee823633e17b7fbe3af8c5b49f2a1
- SHA1
  
  35d196273009ac0aab174662bde3af12cbaf595c
- SHA256
  
  947b389e989ad941ea4f45b29b29f5df1b3eff4d05cdcc970d8982669e627626
- SHA512
  
  a54639bccce7657f4db07cbbfca5492c761464397d5ed847cdf1d2e23aea6ade1050ca094c364a464a5255bae57412a3340d701e799363471ab0b2e29a76e787
- SSDEEP
  
  24576:WlNAsrR4Ao6JJChxd8JqgrmejTBdPR0cdk1nVtGnd:WlN54A3bCF0qsjMnVyd
Score

10^/10

cobaltstrike 0 backdoor discovery trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Cobaltstrike family
  cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

cobaltstrike0backdoordiscoverytrojan