The Information provided at the time of posting was detected as “Cobalt Strike”. Depending on when you are viewing this article, it may no longer be the case and could be determined as being a false positive. Please do your own additional validation. – RedPacket Security

TimeStamp 2022-06-19T08:11:04.430154

General Information

434265231

Cloud Provider	Vultr
Cloud Region	N/A
Service	N/A
Domains	vultrusercontent[.]com
Hostnames	108[.]61[.]162[.]161[.]vultrusercontent[.]com
HTTP Host	108[.]61[.]162[.]161
ISP	The Constant Company, LLC
ORG	Vultr Holdings, LLC
OS	N/A
HTTP	Page Not Found Sorry, but the page you were trying to view does not exist.
HTTP HTML HASH	2101032290
HTTP LOCATION	/
HTTP REDIRECTS
HTTP ROBOTS	N/A
HTTP ROBOTS HASH	N/A
HTTP SECURITY.TXT	N/A
HTTP SECURITY.TXT HASH	N/A
HTTP SERVER	Apache
HTTP SITEMAP	N/A
HTTP SITEMAP HASH	N/A
HTTP TITLE	Page Not Found
LOCATION (AREA CODE)	N/A
LOCATION (CITY)	Yashio
LOCATION (COUNTRY CODE)	JP
LOCATION (COUNTRY NAME)	Japan
LOCATION (LATITUDE)	35.5994
LOCATION (LONGITUDE)	139.7575
LOCATION (POSTAL CODE)	N/A
SSL SERIAL
SSL EXPIRED	N/A
SSL FINGERPRINT (SHA1)	9e757e9e42225a09a2b872587f28e5ff532215d5
SSL ISSUED	20220615175339Z
SSL EXPIRES	20230615175339Z
SSL CYPHER	ECDHE-RSA-AES256-GCM-SHA384
SSL VERSION	TLSv1/SSLv3
SSL TRUST (REVOKED)	N/A
TAGS	cloud, self-signed

Cobalt Strike Beacon Information

Beacon Type	N/A
http-get.client
http-post.client
DNS Beacon MaxDNS	N/A
DNS Beacon Idle	N/A
Beacon Jitter	N/A
dns-beacon.strategy_fail_seconds	N/A
dns-beacon.strategy_rotate_seconds	N/A
dns-beacon.strategy_fail_x	N/A
HTTP GET URI
HTTP POST URI	N/A
Max GET Size	N/A
Port	N/A
post-ex.spawnto_x64
post-ex.spawnto_x86
process-inject.startrwx	N/A
process-inject.userwx	N/A
process-inject.allocator	N/A
proxy.behavior	N/A
sleeptime	N/A
useragent_header	N/A
uses_cookies	N/A
process-inject.execute
Watermark	N/A
Beacon Stage Cleanup	N/A