cobaltstrike

General

Target

magiciso-5.5.281-installer_UGJTy-1.exe.malware
Size

1.7MB
Sample

240506-vygpgsbe6w
MD5

789066d8f14bc09edab6684f91606563
SHA1

d51ea9fdae5fa021945cbd3dba2b93cb1eb2185b
SHA256

9636217af95da9fa67aa45daaac0e07c1c6304f358728be3025cad21e7860cc3
SHA512

4b24724c914f0f0b62d250a9bb5c93ff89186c5a26c5756fb03c6dfe26acb6eb3154db142a7b53212b4081ee60257e4aa9bb61de801cd3bab09ceec6f48ec564
SSDEEP

24576:v7FUDowAyrTVE3U5Fm6j6CnoBopu53TQqMNgYCh4kV4xKFBcRlUHmxnNF:vBuZrEU36Co6pu53Eq/YCK2I2Q7

Score

10^/10

Malware Config

Targets

- Target
  
  magiciso-5.5.281-installer_UGJTy-1.exe.malware
- Size
  
  1.7MB
- MD5
  
  789066d8f14bc09edab6684f91606563
- SHA1
  
  d51ea9fdae5fa021945cbd3dba2b93cb1eb2185b
- SHA256
  
  9636217af95da9fa67aa45daaac0e07c1c6304f358728be3025cad21e7860cc3
- SHA512
  
  4b24724c914f0f0b62d250a9bb5c93ff89186c5a26c5756fb03c6dfe26acb6eb3154db142a7b53212b4081ee60257e4aa9bb61de801cd3bab09ceec6f48ec564
- SSDEEP
  
  24576:v7FUDowAyrTVE3U5Fm6j6CnoBopu53TQqMNgYCh4kV4xKFBcRlUHmxnNF:vBuZrEU36Co6pu53Eq/YCK2I2Q7
Score

10^/10

cobaltstrike zgrat backdoor discovery persistence rat spyware stealer trojan
- Cobalt Strike reflective loader
  Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Drops file in Drivers directory
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Downloads MZ/PE file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2