cobaltstrike

General

Target

CheatEngine75.exe
Size

28.5MB
Sample

240328-zfyx9sgg62
MD5

1e2b14c4f25f109717f8cab97a050bf6
SHA1

188cabf0640e0203fd9c2612586b78ce173f4fd7
SHA256

2cd9a8ef0b8cb972210c0ff94c510034435771420cf404d8db55ab2d1083299f
SHA512

2783e9c4254b04ba35114b673a62d48b720dab2cbd1e2419bc69581d40112a0a7c20531aa47e78d56f1886eb337f9151d1fb969ab26999b186be33254a3c717b
SSDEEP

786432:3TCxuEnwFho+zM77UDZiZCd08jFZJAI5E70TZFH0MU:32EXFhV0KAcNjxAItj0MU

Score

10^/10

Malware Config

Targets

- Target
  
  CheatEngine75.exe
- Size
  
  28.5MB
- MD5
  
  1e2b14c4f25f109717f8cab97a050bf6
- SHA1
  
  188cabf0640e0203fd9c2612586b78ce173f4fd7
- SHA256
  
  2cd9a8ef0b8cb972210c0ff94c510034435771420cf404d8db55ab2d1083299f
- SHA512
  
  2783e9c4254b04ba35114b673a62d48b720dab2cbd1e2419bc69581d40112a0a7c20531aa47e78d56f1886eb337f9151d1fb969ab26999b186be33254a3c717b
- SSDEEP
  
  786432:3TCxuEnwFho+zM77UDZiZCd08jFZJAI5E70TZFH0MU:32EXFhV0KAcNjxAItj0MU
Score

10^/10

cobaltstrike zgrat backdoor discovery evasion persistence rat spyware stealer trojan
- Cobalt Strike reflective loader
  Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Stops running service(s)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1