cobaltstrike

General

Target
2f47a4be84b4e4d165c1f4024402896404f6dcfa61eb4.exe
Size 2.3MB
Sample260313-nf4b7sgv5x
SHA256 2f47a4be84b4e4d165c1f4024402896404f6dcfa61eb47df2d999d749aba072b
MD5 3bda4d693accb639bbc8485585e3f8c0
SHA1 b2f4acc247149b3389a40e23a94869258d082ef5
SHA512 966d8d15b319afb14e12a76f026c73b4ce3e50f28ef30310967150c8b81560300f41e0b1230c9b1782cf40d1c1ac95e36f98de8fe9ff580fa214ffe1eb2f03fa
SSDEEP 49152:nQimDnXG+8yfnOJGuMVFTrEJGrjaTThKHAf7JPfi:nQiCXdptHq7J
TLSH
T197B55A47FCA119F6D5AEA132896269827B71BC481F3257DB2F50B6382F72BD06D74B00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

C2

http://120.76.243.150:8899/1ujM

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.4; InfoPath.2)

Targets

- Target
  2f47a4be84b4e4d165c1f4024402896404f6dcfa61eb4.exe
- Size 2.3MB
- SHA256 2f47a4be84b4e4d165c1f4024402896404f6dcfa61eb47df2d999d749aba072b
- MD5 3bda4d693accb639bbc8485585e3f8c0
- SHA1 b2f4acc247149b3389a40e23a94869258d082ef5
- SHA512 966d8d15b319afb14e12a76f026c73b4ce3e50f28ef30310967150c8b81560300f41e0b1230c9b1782cf40d1c1ac95e36f98de8fe9ff580fa214ffe1eb2f03fa
- SSDEEP 49152:nQimDnXG+8yfnOJGuMVFTrEJGrjaTThKHAf7JPfi:nQiCXdptHq7J
- TLSH
  T197B55A47FCA119F6D5AEA132896269827B71BC481F3257DB2F50B6382F72BD06D74B00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion cobaltstrike trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Cobaltstrike family
  cobaltstrike
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

1

T1012

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Cobaltstrike family

Enumerates VirtualBox registry keys

Looks for VMWare services registry key.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2