Cobra (2).rar
- SHA256 75c9353529159326f6d57a331386bb1e460d8806d57711fcff8d133214ce8ba1
Behavioral task
behavioral1
Sample
Cobra (2).rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Cobra (2).rar
Resource
win10-20240221-en
xworm
147.78.103.53:2723
%AppData%
CraxsRat.exe
https://api.telegram.org/bot7165460947:AAH6f591Qm_-opaAI0oIFjzcZwmJpJlI7Ek/sendMessage?chat_id=5169736402
| resource | yara_rule |
|---|---|
| static1/unpack001/Cobra/1 Cpbra Rat Key Loder.exe | family_xworm |
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
| resource | yara_rule |
|---|---|
| static1/unpack001/Cobra/Cobra.dll | agile_net |
| static1/unpack001/Cobra/LiveCharts.MAPS.dll | agile_net |
| resource | yara_rule |
|---|---|
| static1/unpack001/Cobra/Cobra RAT_protected.exe | themida |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Cobra/1 Cpbra Rat Key Loder.exe |
| unpack001/Cobra/Cobra RAT_protected.exe |
| unpack001/Cobra/Cobra.dll |
| unpack001/Cobra/DrakeUI.Framework.dll |
| unpack001/Cobra/GeoIPCitys.dll |
| unpack001/Cobra/LiveCharts.MAPS.dll |
| unpack001/Cobra/LiveCharts.WinForms.dll |
| unpack001/Cobra/LiveCharts.Wpf.dll |
| unpack001/Cobra/LiveCharts.dll |
| unpack001/Cobra/NAudio.dll |
| unpack001/Cobra/WinMM.Net.dll |
| unpack002/WinMM.Net.dll |
Detect Xworm Payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Mar 8, 2023
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.