General
-
Target
http://64.150.190.149.64
-
Sample
231216-fcyzbabhd9
Score
10/10
Malware Config
Extracted
Family
cobaltstrike
C2
http://185.74.222.145:676/y6Dj
http://185.74.222.145:676/PPDy
Attributes
-
user_agent
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Extracted
Family
connectback
C2
185.74.222.145:957
Targets
-
-
Target
http://64.150.190.149.64
Score10/10-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
ConnectBack
A small Linux reverse shell that establishes a connection back to the attacker.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-