cobaltstrike | 89471638e0c5f81ac5db2280e327a75aa17af8a4a68530938dc8e190803da4b8 | Triage

Sharing

General

Target

89471638e0c5f81ac5db2280e327a75aa17af8a4a68530938dc8e190803da4b8.exe
Size

41KB
Sample

250216-xjmcjavqen
MD5

2027c44050c2a642057436dfb49c0b1d
SHA1

b0ca1f575d25759eea6fb6e10181afe5eb095a82
SHA256

89471638e0c5f81ac5db2280e327a75aa17af8a4a68530938dc8e190803da4b8
SHA512

b0c26f4fe5aff6925a395d53e5e3aaa3b76aad7acecc0dc4f2253eb514eae09ae9fe77ba7f805bb7a55423fbb87c86634c923dfebf4ee471e3d20c4cb8709991
SSDEEP

768:xX4qY61zzS3B0rrN2V0Bicw5RnKd3F1Tsc:xX40U0IHnKX1T3

Score

10^/10

cobaltstrike backdoor discovery trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.0.131:80/MtXD

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Targets

- Target
  
  89471638e0c5f81ac5db2280e327a75aa17af8a4a68530938dc8e190803da4b8.exe
- Size
  
  41KB
- MD5
  
  2027c44050c2a642057436dfb49c0b1d
- SHA1
  
  b0ca1f575d25759eea6fb6e10181afe5eb095a82
- SHA256
  
  89471638e0c5f81ac5db2280e327a75aa17af8a4a68530938dc8e190803da4b8
- SHA512
  
  b0c26f4fe5aff6925a395d53e5e3aaa3b76aad7acecc0dc4f2253eb514eae09ae9fe77ba7f805bb7a55423fbb87c86634c923dfebf4ee471e3d20c4cb8709991
- SSDEEP
  
  768:xX4qY61zzS3B0rrN2V0Bicw5RnKd3F1Tsc:xX40U0IHnKX1T3
Score

10^/10

cobaltstrike backdoor trojan discovery
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Cobaltstrike family
  cobaltstrike
- Downloads MZ/PE file
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

cobaltstrikebackdoortrojan

behavioral2

cobaltstrikebackdoordiscoverytrojan