Cobalt Stike Beacon Detected – 137[.]184[.]118[.]132:10443

Click the icon to Follow me:- twitterTelegramRedditDiscord

The Information provided at the time of posting was detected as “Cobalt Strike”. Depending on when you are viewing this article, it may no longer be the case and could be determined as being a false positive. Please do your own additional validation. – RedPacket Security

TimeStamp 2021-11-10T19:58:08.697664

Cobalt Strike
Cobalt Strike

General Information

3.938258177954358e+41
Cloud ProviderDigitalOcean
Cloud Regionus-ca
ServiceN/A
DomainsN/A
HostnamesN/A
HTTP Host137[.]184[.]118[.]132
ISPDigitalOcean, LLC
ORGDigitalOcean, LLC
OSN/A
HTTPN/A
HTTP HTML HASHN/A
HTTP LOCATION/
HTTP REDIRECTS
HTTP ROBOTSN/A
HTTP ROBOTS HASHN/A
HTTP SECURITY.TXTN/A
HTTP SECURITY.TXT HASHN/A
HTTP SERVERN/A
HTTP SITEMAPN/A
HTTP SITEMAP HASHN/A
HTTP TITLEN/A
LOCATION (AREA CODE)N/A
LOCATION (CITY)Santa Clara
LOCATION (COUNTRY CODE)US
LOCATION (COUNTRY NAME)United States
LOCATION (LATITUDE)37.3924
LOCATION (LONGITUDE)-121.9623
LOCATION (POSTAL CODE)N/A
SSL SERIAL
SSL EXPIREDN/A
SSL FINGERPRINT (SHA1)6b590ae27aceae06f3fe1991b5d53e6758ce9d77
SSL ISSUED20211011145842Z
SSL EXPIRES20220109145841Z
SSL CYPHERECDHE-RSA-AES256-GCM-SHA384
SSL VERSIONTLSv1/SSLv3
SSL TRUST (REVOKED)N/A
TAGScloud


Cobalt Strike Beacon Information

Beacon TypeHTTPS
http-get.clientHost: d2bqcornbekf3d[.]cloudfront[.]net, Accept: text/html,application/xhtml+xml,application/xml;q=0[.]9,*/*;q=0[.]8, Accept-Language: en-US,en;q=0[.]5, REF=ID=C3wmqWh7OybKI, Cookie
http-post.clientHost: d2bqcornbekf3d[.]cloudfront[.]net, Accept: text/html,application/xhtml+xml,application/xml;q=0[.]9,*/*;q=0[.]8, Accept-Language: en-US,en;q=0[.]5, U=C3wmqWh7OybKI, REF=ID=, Cookie
DNS Beacon MaxDNSN/A
DNS Beacon IdleN/A
Beacon Jitter17
dns-beacon.strategy_fail_seconds-1
dns-beacon.strategy_rotate_seconds-1
dns-beacon.strategy_fail_x-1
HTTP GET URId3q394xo39ws7d[.]cloudfront[.]net,/safebrowsing/dLqveEIZ/Tm36OZriEvFtCFLfJ-xjr1-1MwxASNlaa2iLup,d31um39t4523hw[.]cloudfront[.]net,/safebrowsing/dLqveEIZ/Tm36OZriEvFtCFLfJ-xjr1-1MwxASNlaa2iLup
HTTP POST URI/safebrowsing/dLqveEIZ/Tm36OZriEvFtCFLfJ-xjr1-1MwxASNlaa2iRhn
Max GET Size1048576
Port443
post-ex.spawnto_x64%windir%\sysnative\choice[.]exe
post-ex.spawnto_x86%windir%\syswow64\choice[.]exe
process-inject.startrwx64
process-inject.userwx32
process-inject.allocator1
proxy.behavior2 (Use IE settings)
sleeptime46000
useragent_headerMozilla/5.0 (X11; Linux x86_64; rv:70.0) Gecko/20100101 Firefox/70.0
uses_cookies1
process-inject.executentdll.dll:RtlUserThreadStart, NtQueueApcThread-s, SetThreadContext, CreateRemoteThread, kernel32.dll:LoadLibraryA, RtlCreateUserThread
Watermark425486863
Beacon Stage Cleanup1
Available for Amazon Prime