cobaltstrike

General

Target

2025-03-30_49bcdd0ccd416106b2c1713b4f23e907_amadey_cobalt-strike_poet-rat_smoke-loader
Size

5.9MB
Sample

250330-zl7scswyhx
MD5

49bcdd0ccd416106b2c1713b4f23e907
SHA1

29dbcee42312246d5aabccc091976659a297234e
SHA256

78e343dbc2a61da3355b5417d83e6c2e91f1619fc88a1cb069b5a7cab13ce642
SHA512

8a13febd375bee261e1067e5a660907d75e403f14272c087b1783a428daadc1b7027abef5b2bdc59767d784131585dddaba7934fffb973d6964c18e58b019cc7
SSDEEP

98304:oemTLkNdfE0pZrD56utgpPFotBER/mQ32lUm:T+q56utgpPF8u/7m

Score

10^/10

Malware Config

Targets

- Target
  
  2025-03-30_49bcdd0ccd416106b2c1713b4f23e907_amadey_cobalt-strike_poet-rat_smoke-loader
- Size
  
  5.9MB
- MD5
  
  49bcdd0ccd416106b2c1713b4f23e907
- SHA1
  
  29dbcee42312246d5aabccc091976659a297234e
- SHA256
  
  78e343dbc2a61da3355b5417d83e6c2e91f1619fc88a1cb069b5a7cab13ce642
- SHA512
  
  8a13febd375bee261e1067e5a660907d75e403f14272c087b1783a428daadc1b7027abef5b2bdc59767d784131585dddaba7934fffb973d6964c18e58b019cc7
- SSDEEP
  
  98304:oemTLkNdfE0pZrD56utgpPFotBER/mQ32lUm:T+q56utgpPF8u/7m
Score

10^/10

cobaltstrike xmrig backdoor miner trojan upx persistence privilege_escalation
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Cobaltstrike family
  cobaltstrike
- Xmrig family
  xmrig
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Accessibility Features

1

T1546.008

Privilege Escalation

Event Triggered Execution

1

T1546

Accessibility Features

1

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Cobaltstrike family

Xmrig family

xmrig

XMRig Miner payload

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2