cobaltstrike

General

Target

.
Size

153KB
Sample

240425-txmnnsce2z
MD5

08d1f5757f6928c73744abc44413fa85
SHA1

49582f232d0b1914c2d414c3dbdaafeb757030e0
SHA256

1090fa5d955afdfd132851155576f9c8c5dff3f6eebb00e108dd4baececa14f0
SHA512

a991c77cbc9016b77231e3af04f4420d2eb527d3daf988a6256a1cef8ae4341f3e11ecdc29c62adab441f33ff47452ecd78609056f5875dd78b909b57598add3
SSDEEP

1536:oCkRyP2d8LonVJoqYarK4DsYNgRyypRMPuNPV5nPztP4FPfaParP8R4DJ2PWTllV:pkRyPXL6WVMllhAYyHhqiS

Score

10^/10

Malware Config

Targets

- Target
  
  .
- Size
  
  153KB
- MD5
  
  08d1f5757f6928c73744abc44413fa85
- SHA1
  
  49582f232d0b1914c2d414c3dbdaafeb757030e0
- SHA256
  
  1090fa5d955afdfd132851155576f9c8c5dff3f6eebb00e108dd4baececa14f0
- SHA512
  
  a991c77cbc9016b77231e3af04f4420d2eb527d3daf988a6256a1cef8ae4341f3e11ecdc29c62adab441f33ff47452ecd78609056f5875dd78b909b57598add3
- SSDEEP
  
  1536:oCkRyP2d8LonVJoqYarK4DsYNgRyypRMPuNPV5nPztP4FPfaParP8R4DJ2PWTllV:pkRyPXL6WVMllhAYyHhqiS
Score

10^/10

cobaltstrike zgrat backdoor discovery exploit persistence rat spyware stealer trojan
- Cobalt Strike reflective loader
  Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1