cobaltstrike | e09a5e8f5760bcd7d6e5c5db19ef0de8eb63ea16161d2130bf10fbfdab02acc9

General

Target
e09a5e8f5760bcd7d6e5c5db19ef0de8eb63ea16161d2130bf10fbfdab02acc9
Size 199KB
Sample260831-m87pnaszcs
SHA256 e09a5e8f5760bcd7d6e5c5db19ef0de8eb63ea16161d2130bf10fbfdab02acc9
MD5 981557bdebb4e52d18dcd9fd167ee78e
SHA1 c09c9d7ef2cfec218de1b8326917a3c5c58c6610
SHA512 43d0dcd01e4d0458297e99dec4e075f64700e1b92543d6273198516637a9861f899d9c1d029d02fc379308dc2235543612952bab3e0be87215f0e4c92c2dd7f9
SSDEEP 6144:EadhDZH7HttxhJJSFJqZ4adhDZH7HttxhJJSFJ4:EeZrtDhuHa4eZrtDhuH4
TLSH
T1891412764B6ADF2AF62251B257355214DF991B8FEB61BB6CB80D9EE0BC01DC400C2736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

C2

http://154.206.90.105:3333/NiYM

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Targets

- Target
  2323/DsArk64_win10.sys
- Size 177KB
- SHA256 cd3d1a2e119cbbb41ec0e7d7fb17bac106735d62b33ed3cde10087af1da89403
- MD5 b4b6aaa2ee1cc344b7c6752778a279e5
- SHA1 c55e4846c361f1481ec2588173414eb6f86b9b37
- SHA512 cd14a7f57a59b9e66d549fb04f4ce7b89656d3934d991229348f49b65d78e12f62ddfba032e8df5413df6cbaacec83c0f159987c637dd632a90740a88629cb12
- SSDEEP 3072:xiRc3FVtWOvLve3U/idufEXnGWZC5hPEEvqLyKCkCtu112fA/1/Qyj/XJ6FexP0O:SYVtfLvV/lfE3GW45hMEiLkptu112fAN
- TLSH
  T1C3047C51E26A14F9D6B7D9BACAD5C627FBB2B411430557CF42A18BA41E133F0FA38309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  2323/dsark64.sys
- Size 177KB
- SHA256 cd3d1a2e119cbbb41ec0e7d7fb17bac106735d62b33ed3cde10087af1da89403
- MD5 b4b6aaa2ee1cc344b7c6752778a279e5
- SHA1 c55e4846c361f1481ec2588173414eb6f86b9b37
- SHA512 cd14a7f57a59b9e66d549fb04f4ce7b89656d3934d991229348f49b65d78e12f62ddfba032e8df5413df6cbaacec83c0f159987c637dd632a90740a88629cb12
- SSDEEP 3072:xiRc3FVtWOvLve3U/idufEXnGWZC5hPEEvqLyKCkCtu112fA/1/Qyj/XJ6FexP0O:SYVtfLvV/lfE3GW45hMEiLkptu112fAN
- TLSH
  T1C3047C51E26A14F9D6B7D9BACAD5C627FBB2B411430557CF42A18BA41E133F0FA38309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  2323/workercn1.ddl.exe
- Size 19KB
- SHA256 f1ccf0f172d02e7370e8bee2469dee66fabfe6bc031682074914fa40c3ac7bbb
- MD5 62a44ab8a4ee8d257c522e5efba5d7d3
- SHA1 28c35c6f698445189b8ffebb6b0bf55af00c2ea2
- SHA512 cc1b2daadcf6b50db5044f14dfc78573e963bd62b16e8ab0b791d3c34d0894cdc910a13e0642bfd0fd9f2db60a4a53445e18de75c59ec0f5550d46a521d8a946
- SSDEEP 192:xV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2XeWF8qa1Dojjgi:DqaCF31cix+Dc4zjCfFF46gi
- TLSH
  T18A92EA3FE71368E9C106D57845FF2733DCB13DB385A6972E2724D2B42E106A46EAA910
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor cobaltstrike trojan
- Family: Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Cobaltstrike

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6