cobaltstrike

General

Target

Opiumistic-updater‮exe‭..bat
Size

3.5MB
Sample

240520-148m2shh81
MD5

0ed8d9bbf39a519a8cdbe3dda98c2486
SHA1

9447337bfe0b402ccedf37fff00da04ec8653b3f
SHA256

2f0b30365c7dc664aa716f98322a5b8c06f2bce274c72f2ac8410f9bea6678d0
SHA512

df8b9e2e667b8a144c0aead2deb535136057ed8c113c70491e1dc527c766ca22d78bc44cfc71b0e61334665fb5a14cc1028eaa85278783ae3bb41642f9e2f638
SSDEEP

3072:NdEATwBuBsKxMK0XNAq2Qg3tucyz6pLlVAVzOWNjn7NWy/LTAcZmMGDbfbL:NwuBsaMRfA34pmpBuVzO8ZTTAZf

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://discord.com/api/webhooks/1237966605632274442/sDaF_GAaP7L2QwOUgs0HlhoORoyEboDcMmn2nSitkMKVMuhpVfwSGfX9Fbjt_YGBaDJV

exe.dropper

https://i.imgur.com/DOIYOtp.gif

exe.dropper

https://github.com/ChildrenOfYahweh/Kematian-Stealer/raw/main/frontend-src/blockhosts.ps1

exe.dropper

https://github.com/ChildrenOfYahweh/Kematian-Stealer/raw/main/frontend-src/antivm.ps1

exe.dropper

http://ip-api.com/json

Targets

- Target
  
  Opiumistic-updater‮exe‭..bat
- Size
  
  3.5MB
- MD5
  
  0ed8d9bbf39a519a8cdbe3dda98c2486
- SHA1
  
  9447337bfe0b402ccedf37fff00da04ec8653b3f
- SHA256
  
  2f0b30365c7dc664aa716f98322a5b8c06f2bce274c72f2ac8410f9bea6678d0
- SHA512
  
  df8b9e2e667b8a144c0aead2deb535136057ed8c113c70491e1dc527c766ca22d78bc44cfc71b0e61334665fb5a14cc1028eaa85278783ae3bb41642f9e2f638
- SSDEEP
  
  3072:NdEATwBuBsKxMK0XNAq2Qg3tucyz6pLlVAVzOWNjn7NWy/LTAcZmMGDbfbL:NwuBsaMRfA34pmpBuVzO8ZTTAZf
Score

10^/10

cobaltstrike backdoor discovery execution exploit persistence spyware stealer trojan
- Cobalt Strike reflective loader
  Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Creates new service(s)
  persistence execution
- Downloads MZ/PE file
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1