cobaltstrike | e7f295bb2518ccdd96474721ab4beeb15915782aaf909c76e345a2f8183c0d43

General

Target
e7f295bb2518ccdd96474721ab4beeb15915782aaf909c76e345a2f8183c0d43
Size 3.0MB
Sample260814-aaak2s1cmh
SHA256 e7f295bb2518ccdd96474721ab4beeb15915782aaf909c76e345a2f8183c0d43
MD5 e5e82bf10bbbc1862db10a75a62e0901
SHA1 e7c4004f91a2d3e64cbe20b4e324fb763d837a12
SHA512 90585979f1a50948d2ad5a42d42cf7812d6bbe55db9194d18e5179fc0cbd51ef98979b6cba6041a1a413d38c9dea751c75eac196f0594d8c690a8a5830e8b1a8
SSDEEP 49152:AonNlr8qdbTJMVL5aKiHmI1w/SKd5/ykyAlI7IzHgAp:7/IuhWyOI7UJ
TLSH
T187E56B12FCE214F6C5BEF13486A676267A70387543313BD35EC858AA2A65FE43A3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

893838267

Attributes

beacon_type
512
http_header1
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
pipe_name
\\.\pipe\mojo.5688.8052.1838949392370888572b
polling_time
10000
port_number
4444
sc_process32
%windir%\syswow64\svchost.exe -k netsvcs -o -s DsmSvc
sc_process64
%windir%\sysnative\svchost.exe -k netsvcs -o -s DsmSvc
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCguJovuu7m2mRSrR7Gjp6dasqT98di8z/r6bfZT0VXr900g33osmCqYprx7vyxFVgkPX156M8M9uTClQnJXLRDZWFaKOnaPar9DYZKn4HrsTf+Wbfa+WqRt1VULKZwqwQWHRrLbqwwvwp/wwoheTPP70S5wdp91nAN8kTB8HE95wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
watermark
893838267

Targets

- Target
  e7f295bb2518ccdd96474721ab4beeb15915782aaf909c76e345a2f8183c0d43
- Size 3.0MB
- SHA256 e7f295bb2518ccdd96474721ab4beeb15915782aaf909c76e345a2f8183c0d43
- MD5 e5e82bf10bbbc1862db10a75a62e0901
- SHA1 e7c4004f91a2d3e64cbe20b4e324fb763d837a12
- SHA512 90585979f1a50948d2ad5a42d42cf7812d6bbe55db9194d18e5179fc0cbd51ef98979b6cba6041a1a413d38c9dea751c75eac196f0594d8c690a8a5830e8b1a8
- SSDEEP 49152:AonNlr8qdbTJMVL5aKiHmI1w/SKd5/ykyAlI7IzHgAp:7/IuhWyOI7UJ
- TLSH
  T187E56B12FCE214F6C5BEF13486A676267A70387543313BD35EC858AA2A65FE43A3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor 893838267 cobaltstrike trojan
- Family: Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Cobaltstrike

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2