cobaltstrike | 4874888279e5650648b66724725be67c66970d41d1f43ab80d918e962deb3408

General

Target
2026-09-20_40402a82d6264a0d94a9deb4951a09aa_amadey_avoslocker_elex_luca-stealer_lynx_njrat_redline-stealer
Size 1.4MB
Sample260921-lydhdsff89
SHA256 4874888279e5650648b66724725be67c66970d41d1f43ab80d918e962deb3408
MD5 40402a82d6264a0d94a9deb4951a09aa
SHA1 c588c6bb68b071c529223ad7b4262322e6aea673
SHA512 fd5aa6ff1b68335518336976e2d2c701dfb9548bea062830c20d71c6ecafe25b42667b74508c4affdc888c5f7cbd22d766b286e3c9fd143969f3a1b838de4d8b
SSDEEP 24576:AEwKj1V/USg6uDvOWEthn74YrH67Gf1l2w1cDPtT7D:AEwijMSzuCWET0YrH67+n2wqPtT/
TLSH
T1F8659E01F501A13AF8F340BBCEFE692DD658AA61130954E7B3C8594F8B62EF27932157
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://189.51.118.17:8443/jquery-3.3.1.min.js

Attributes

access_type
512
beacon_type
2048
host
189.51.118.17
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADQAAAAIAAAAJX19jZmR1aWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADwAAAA0AAAAFAAAACF9fY2ZkdWlkAAAABwAAAAEAAAAPAAAADQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
2560
polling_time
5000
port_number
8443
sc_process32
%windir%\syswow64\dllhost.exe
sc_process64
%windir%\sysnative\dllhost.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQChhj4GNtKh1fdIUrcQEnvN6oHYQAYCQ3/JRwV2OtkiiuP32FLO0qx5V89K9K2JzFec8TtDHISfHyGwiqJU5cHkza0a0F8ol21bmGub/Ch2/W49ZYriHqpY2uMnCP/8qBI1Suo6VvlqCFK5UmGbo2HMxXUPuS7WiDvJUOIBKtonCwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4.234810624e+09
unknown2
AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/jquery-3.3.2.min.js
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
watermark
0

Targets

- Target
  2026-09-20_40402a82d6264a0d94a9deb4951a09aa_amadey_avoslocker_elex_luca-stealer_lynx_njrat_redline-stealer
- Size 1.4MB
- SHA256 4874888279e5650648b66724725be67c66970d41d1f43ab80d918e962deb3408
- MD5 40402a82d6264a0d94a9deb4951a09aa
- SHA1 c588c6bb68b071c529223ad7b4262322e6aea673
- SHA512 fd5aa6ff1b68335518336976e2d2c701dfb9548bea062830c20d71c6ecafe25b42667b74508c4affdc888c5f7cbd22d766b286e3c9fd143969f3a1b838de4d8b
- SSDEEP 24576:AEwKj1V/USg6uDvOWEthn74YrH67Gf1l2w1cDPtT7D:AEwijMSzuCWET0YrH67+n2wqPtT/
- TLSH
  T1F8659E01F501A13AF8F340BBCEFE692DD658AA61130954E7B3C8594F8B62EF27932157
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor 0 discovery cobaltstrike trojan
- Family: Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Cobaltstrike

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2