Cobalt Stike Beacon Detected – 95[.]179[.]212[.]90:8443

The Information provided at the time of posting was detected as “Cobalt Strike”. Depending on when you are viewing this article, it may no longer be the case and could be determined as being a false positive. Please do your own additional validation. – RedPacket Security

TimeStamp 2021-11-15T17:46:49.477499

General Information

2140453927

Cloud Provider	Vultr
Cloud Region	N/A
Service	N/A
Domains	vultr[.]com
Hostnames	95[.]179[.]212[.]90[.]vultr[.]com
HTTP Host	95[.]179[.]212[.]90
ISP	The Constant Company, LLC
ORG	The Constant Company, LLC
OS	N/A
HTTP	N/A
HTTP HTML HASH	N/A
HTTP LOCATION	/
HTTP REDIRECTS
HTTP ROBOTS	N/A
HTTP ROBOTS HASH	N/A
HTTP SECURITY.TXT	N/A
HTTP SECURITY.TXT HASH	N/A
HTTP SERVER	N/A
HTTP SITEMAP	N/A
HTTP SITEMAP HASH	N/A
HTTP TITLE	N/A
LOCATION (AREA CODE)	N/A
LOCATION (CITY)	Paris
LOCATION (COUNTRY CODE)	FR
LOCATION (COUNTRY NAME)	France
LOCATION (LATITUDE)	48.85341
LOCATION (LONGITUDE)	2.3488
LOCATION (POSTAL CODE)	N/A
SSL SERIAL
SSL EXPIRED	N/A
SSL FINGERPRINT (SHA1)	64088343632036c9ae2860efc2ab18a257d2b8b2
SSL ISSUED	20211115035528Z
SSL EXPIRES	20221115035528Z
SSL CYPHER	ECDHE-RSA-AES256-GCM-SHA384
SSL VERSION	TLSv1/SSLv3
SSL TRUST (REVOKED)	N/A
TAGS	cloud, self-signed

Cobalt Strike Beacon Information

Beacon Type	HTTPS
http-get.client	Accept: text/html,application/xhtml+xml,application/xml;q=0[.]9,*/*;q=0[.]8, Referer: http://code[.]jquery[.]com/, Accept-Encoding: gzip, deflate, __cfduid=, Cookie
http-post.client	Accept: text/html,application/xhtml+xml,application/xml;q=0[.]9,*/*;q=0[.]8, Referer: http://code[.]jquery[.]com/, Accept-Encoding: gzip, deflate, __cfduid
DNS Beacon MaxDNS	N/A
DNS Beacon Idle	N/A
Beacon Jitter	50
dns-beacon.strategy_fail_seconds	-1
dns-beacon.strategy_rotate_seconds	-1
dns-beacon.strategy_fail_x	-1
HTTP GET URI	172[.]64[.]32[.]117,/jquery-3[.]3[.]1[.]min[.]js,108[.]162[.]192[.]117,/jquery-3[.]3[.]1[.]min[.]js,173[.]245[.]58[.]117,/jquery-3[.]3[.]1[.]min[.]js
HTTP POST URI	/jquery-3.3.2.min.js
Max GET Size	1403644
Port	8443
post-ex.spawnto_x64	%windir%\sysnative\svchost[.]exe
post-ex.spawnto_x86	%windir%\syswow64\svchost[.]exe
process-inject.startrwx	4
process-inject.userwx	32
process-inject.allocator	1
proxy.behavior	2 (Use IE settings)
sleeptime	14566
useragent_header	Mozilla/5.0 (X11; Linux x86_64:71.0) Gecko/20100101 Firefox/71.0
uses_cookies	1
process-inject.execute	ntdll.dll:RtlUserThreadStart, NtQueueApcThread-s, SetThreadContext, CreateRemoteThread, kernel32.dll:LoadLibraryA, RtlCreateUserThread
Watermark	1234567890
Beacon Stage Cleanup	1