cobaltstrike

General

Target

sample
Size

19KB
Sample

240510-zcys4abe33
MD5

324bc9f4391f4b33c71a67f8f965418b
SHA1

1b6ac7844a86237df3f39a03d4c2cc4453cb0feb
SHA256

f06db9c75a06300eaec988614ad581b745932be9899229a31cdbd4ffc7694bd2
SHA512

2b605b2d5b2e7d5759f8d4f844ce9f059a7dede64a927173b84e982b26e76bd8401e2ebc648c6a62af0c94d2238f965b7249cdf7236d3c160f630342b63551c0
SSDEEP

384:rbKrrqDpmReVoOs4Qi9ylKeGMmU8HhhbiQi7dro2paWhOwob0Jn+tIJCgMmVn:rgWBVoOs4QmyI1MsBhbvkdKWhOwob0Jj

Score

10^/10

Malware Config

Targets

- Target
  
  sample
- Size
  
  19KB
- MD5
  
  324bc9f4391f4b33c71a67f8f965418b
- SHA1
  
  1b6ac7844a86237df3f39a03d4c2cc4453cb0feb
- SHA256
  
  f06db9c75a06300eaec988614ad581b745932be9899229a31cdbd4ffc7694bd2
- SHA512
  
  2b605b2d5b2e7d5759f8d4f844ce9f059a7dede64a927173b84e982b26e76bd8401e2ebc648c6a62af0c94d2238f965b7249cdf7236d3c160f630342b63551c0
- SSDEEP
  
  384:rbKrrqDpmReVoOs4Qi9ylKeGMmU8HhhbiQi7dro2paWhOwob0Jn+tIJCgMmVn:rgWBVoOs4QmyI1MsBhbvkdKWhOwob0Jj
Score

10^/10

cobaltstrike zgrat adware backdoor discovery evasion execution exploit persistence rat spyware stealer trojan
- Cobalt Strike reflective loader
  Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Creates new service(s)
  persistence execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
- Modifies Installed Components in the registry
  persistence
- Possible privilege escalation attempt
  exploit
- Sets file execution options in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops Chrome extension
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Modifies powershell logging option
  evasion
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1