Cobalt Stike Beacon Detected – 207[.]148[.]112[.]179:443

Click the icon to Follow me:- twitterTelegramRedditDiscord

The Information provided at the time of posting was detected as “Cobalt Strike”. Depending on when you are viewing this article, it may no longer be the case and could be determined as being a false positive. Please do your own additional validation. – RedPacket Security

TimeStamp 2021-11-14T14:42:30.897961

Cobalt Strike
Cobalt Strike

General Information

4.239079043047228e+47
Cloud ProviderVultr
Cloud RegionN/A
ServiceN/A
Domainsvultr[.]com
Hostnames207[.]148[.]112[.]179[.]vultr[.]com
HTTP Host207[.]148[.]112[.]179
ISPThe Constant Company, LLC
ORGThe Constant Company, LLC
OSN/A
HTTPN/A
HTTP HTML HASHN/A
HTTP LOCATION/
HTTP REDIRECTS
HTTP ROBOTSN/A
HTTP ROBOTS HASHN/A
HTTP SECURITY.TXTN/A
HTTP SECURITY.TXT HASHN/A
HTTP SERVERgolfe2
HTTP SITEMAPN/A
HTTP SITEMAP HASHN/A
HTTP TITLEN/A
LOCATION (AREA CODE)N/A
LOCATION (CITY)Tokyo
LOCATION (COUNTRY CODE)JP
LOCATION (COUNTRY NAME)Japan
LOCATION (LATITUDE)35.6895
LOCATION (LONGITUDE)139.69171
LOCATION (POSTAL CODE)N/A
SSL SERIAL
SSL EXPIREDN/A
SSL FINGERPRINT (SHA1)3c8b84e788609304515fe91084676015d70f0b02
SSL ISSUED20210512080700Z
SSL EXPIRES20360508080700Z
SSL CYPHERECDHE-RSA-AES256-GCM-SHA384
SSL VERSIONTLSv1/SSLv3
SSL TRUST (REVOKED)N/A
TAGScloud


Cobalt Strike Beacon Information

Beacon TypeHTTPS
http-get.clientHost: google[.]com, Connection: close, Accept: */*, Accept-Language: en-GB;q=0[.]9, *;q=0[.]7, wordpress_d6c0405e0d7ab18fd4e6a0b74fce40b0=, Cookie
http-post.clientHost: google[.]com, Connection: close, Accept-Encoding: gzip, br, Content-Type: application/x-www-form-urlencoded, route=, __session__id=, Cookie
DNS Beacon MaxDNS254
DNS Beacon Idle-1955653841
Beacon Jitter43
dns-beacon.strategy_fail_secondsN/A
dns-beacon.strategy_rotate_secondsN/A
dns-beacon.strategy_fail_xN/A
HTTP GET URImicrosoft[.]update[.]flash[.]com[.]se,/fam_calendar
HTTP POST URI/bm
Max GET Size1864478
Port443
post-ex.spawnto_x64%windir%\sysnative\svchost[.]exe
post-ex.spawnto_x86%windir%\syswow64\svchost[.]exe
process-inject.startrwx4
process-inject.userwx32
process-inject.allocatorN/A
proxy.behavior2 (Use IE settings)
sleeptime3000
useragent_headerMozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0
uses_cookies1
process-inject.executeCreateThread, RtlCreateUserThread, CreateRemoteThread
Watermark388888888
Beacon Stage Cleanup1
Available for Amazon Prime