cobaltstrike

General

Target

barbiegamer - Linkvertise Downloader_5DnBA-1.exe
Size

10.8MB
Sample

230908-jv77gshh85
MD5

fc30f38c629fbafcfd1f4a4895814c46
SHA1

e6b298591f7034463f603ede1573c8a198938b7f
SHA256

40e1b53fb04746ac4a0561f5ab781291069b90232215afc36320263308a28ec9
SHA512

74aba9bd29a9d6200f5b35a15f66c6edb57b3a8cfa24b3c04f2a90224d64bcda7564047a5f88698107aaf5e18c6d22bc6d8f5f3fdfdda2bb86aeb800d90e37d2
SSDEEP

196608:w38JJEU16hTZl583S0LJu+mzfDkzXJKUNWGJ3k2ZoXOM1ugha:Z1MlCC0Ybzf4zZKUok5oXN8x

Score

10^/10

Malware Config

Targets

- Target
  
  barbiegamer - Linkvertise Downloader_5DnBA-1.exe
- Size
  
  10.8MB
- MD5
  
  fc30f38c629fbafcfd1f4a4895814c46
- SHA1
  
  e6b298591f7034463f603ede1573c8a198938b7f
- SHA256
  
  40e1b53fb04746ac4a0561f5ab781291069b90232215afc36320263308a28ec9
- SHA512
  
  74aba9bd29a9d6200f5b35a15f66c6edb57b3a8cfa24b3c04f2a90224d64bcda7564047a5f88698107aaf5e18c6d22bc6d8f5f3fdfdda2bb86aeb800d90e37d2
- SSDEEP
  
  196608:w38JJEU16hTZl583S0LJu+mzfDkzXJKUNWGJ3k2ZoXOM1ugha:Z1MlCC0Ybzf4zZKUok5oXN8x
Score

10^/10

cobaltstrike backdoor coreentity discovery persistence spyware stealer trojan
- Cobalt Strike reflective loader
  Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Suspicious use of NtCreateUserProcessOtherParentProcess
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1