cobaltstrike

General

Target
MEmu-setup-abroad-sdk-mv.exe
Size 23.0MB
Sample240303-m79gvsaa45
SHA256 89174acde0ea21562e6186847ba7d12aacd9b2b2132f456dd8335680daadd9a9
MD5 f9ce897d93d4f77bca3cca8541a8addb
SHA1 4ac5a68266c842fb997fd755c9d10d1975baa71f
SHA512 57ad25f1a3b1514e579fd9f61102d0e6ea42e32bb9371fa447ab6e8c4403a018ee5b1959f3038dd591c930ecc4b535abe6851693334a67542acb7877152b0a6a
SSDEEP 393216:w95Rjktqn778Sd3o+83Jsv6tWKFdu9CwvUiPbKv647n+YlmYz:MRjkG7Iq3oOD2vegm0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  MEmu-setup-abroad-sdk-mv.exe
- Size 23.0MB
- SHA256 89174acde0ea21562e6186847ba7d12aacd9b2b2132f456dd8335680daadd9a9
- MD5 f9ce897d93d4f77bca3cca8541a8addb
- SHA1 4ac5a68266c842fb997fd755c9d10d1975baa71f
- SHA512 57ad25f1a3b1514e579fd9f61102d0e6ea42e32bb9371fa447ab6e8c4403a018ee5b1959f3038dd591c930ecc4b535abe6851693334a67542acb7877152b0a6a
- SSDEEP 393216:w95Rjktqn778Sd3o+83Jsv6tWKFdu9CwvUiPbKv647n+YlmYz:MRjkG7Iq3oOD2vegm0
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

cobaltstrike zgrat backdoor discovery persistence rat spyware stealer trojan
- Cobalt Strike reflective loader
  Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Drops file in Drivers directory
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Downloads MZ/PE file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2 behavioral3