192.64.119[.]19IP address

Reported by 1 independent source · first reported 9 Sep 2022 by Elastic Security Labs · last reported 9 Sep 2022

Last reported 4 years ago

What the reports say

1 report, newest first · the exact sentence from each

“…andclinic.cloud | domain-name | Cobalt Strike Malleable C2 domain 104.197.142.19 | ipv4-addr | Cobalt Strike Malleable C2 IP address 192.64.119[.]19 | ipv4-addr | Cobalt Strike Malleable C2 IP address”

Elastic Security LabsVendor9 Sep 2022C2
Extracting Cobalt Strike Beacon Configurations

Indicators reported together

named in the same reports

clevelandclinic[.]cloudin 1 report
222b8f27dbdfba8ddd559eeca27ea648in 1 report
7af9c759ac78da92…b30b00a8a858in 1 report
hxxps://verify.cobaltstrike[.]comin 1 report
verify.cobaltstrike[.]comin 1 report
697fddfc51958287…98c4456a3f89in 1 report
7475a6c08fa90e7a…a87a43ac7ac4in 1 report
f9b38c422a89d73e…45183c946fc5in 1 report
104.197.142[.]19in 1 report

Copy these 9 indicators · defanged

9 indicators, defanged, one per line

clevelandclinic[.]cloud
222b8f27dbdfba8ddd559eeca27ea648
7af9c759ac78da920395debb443b9007fdf51fa66a48f0fbdaafb30b00a8a858
hxxps://verify.cobaltstrike[.]com
verify.cobaltstrike[.]com
697fddfc5195828777622236f2b133c0a24a6d0dc539ae7da41798c4456a3f89
7475a6c08fa90e7af36fd7aa76be6e06b9e887bc0a6501914688a87a43ac7ac4
f9b38c422a89d73ebdab7c142c8920690ee3a746fc4eea9175d745183c946fc5
104.197.142[.]19

Thanks — we review every report.

Report a wrong value