cobaltstrike

General

Target

d1ba36388bcc42d5e86cb69f89997bfeac331ad7e4abe7366f32b8002ed4fe9c
Size

272KB
Sample

221126-yrlxeaah75
MD5

8d0d776191e0e91610d229330e321ded
SHA1

3c3a797b8663d99c35b690540c9773358c26a4de
SHA256

d1ba36388bcc42d5e86cb69f89997bfeac331ad7e4abe7366f32b8002ed4fe9c
SHA512

c9e5447094311c768e64025ff2733118a728928c4115f4a6f10d9bbafb1e4efab9f2c57e931567f693b0ae111fd0acd4c96a83af5400d570bfd694e72dfd1654
SSDEEP

6144:BeTeM/6m97ccRErXeecYzVRr33GRHX2dvt4ILKc43:1MXZ2rXeeFRD6HXiFlE3

Score

10^/10

Malware Config

Targets

- Target
  
  d1ba36388bcc42d5e86cb69f89997bfeac331ad7e4abe7366f32b8002ed4fe9c
- Size
  
  272KB
- MD5
  
  8d0d776191e0e91610d229330e321ded
- SHA1
  
  3c3a797b8663d99c35b690540c9773358c26a4de
- SHA256
  
  d1ba36388bcc42d5e86cb69f89997bfeac331ad7e4abe7366f32b8002ed4fe9c
- SHA512
  
  c9e5447094311c768e64025ff2733118a728928c4115f4a6f10d9bbafb1e4efab9f2c57e931567f693b0ae111fd0acd4c96a83af5400d570bfd694e72dfd1654
- SSDEEP
  
  6144:BeTeM/6m97ccRErXeecYzVRr33GRHX2dvt4ILKc43:1MXZ2rXeeFRD6HXiFlE3
Score

10^/10

cobaltstrike backdoor bootkit discovery persistence spyware stealer trojan upx
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Registers COM server for autorun
  persistence
- Sets file execution options in registry
  persistence
- Sets service image path in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2