cobaltstrike

General

Target

2025-03-28_98260699709b108a541be854e33089f7_amadey_cobalt-strike_poet-rat_smoke-loader
Size

5.9MB
Sample

250328-2z18vavns5
MD5

98260699709b108a541be854e33089f7
SHA1

30d9b00d32cac00eedd3498651b56cafdcdd9c1e
SHA256

49f1655acd9b9b735d275316816ee77e9e59f01b523588999a9c306c93e08162
SHA512

c3703c47e3648767c726fc8eadd5ba1b04329703355c94816572e54263374411b899e7804b6bbd883783ad97ce52d6d8dc0c7e193a78c4d5a35ab9a333bed0f5
SSDEEP

98304:oemTLkNdfE0pZrD56utgpPFotBER/mQ32lUP:T+q56utgpPF8u/7P

Score

10^/10

Malware Config

Targets

- Target
  
  2025-03-28_98260699709b108a541be854e33089f7_amadey_cobalt-strike_poet-rat_smoke-loader
- Size
  
  5.9MB
- MD5
  
  98260699709b108a541be854e33089f7
- SHA1
  
  30d9b00d32cac00eedd3498651b56cafdcdd9c1e
- SHA256
  
  49f1655acd9b9b735d275316816ee77e9e59f01b523588999a9c306c93e08162
- SHA512
  
  c3703c47e3648767c726fc8eadd5ba1b04329703355c94816572e54263374411b899e7804b6bbd883783ad97ce52d6d8dc0c7e193a78c4d5a35ab9a333bed0f5
- SSDEEP
  
  98304:oemTLkNdfE0pZrD56utgpPFotBER/mQ32lUP:T+q56utgpPF8u/7P
Score

10^/10

cobaltstrike xmrig backdoor miner persistence privilege_escalation trojan upx
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Cobaltstrike family
  cobaltstrike
- Xmrig family
  xmrig
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Accessibility Features

1

T1546.008

Privilege Escalation

Event Triggered Execution

1

T1546

Accessibility Features

1

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Cobaltstrike family

Xmrig family

xmrig

XMRig Miner payload

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2