cobaltstrike

General

Target

x-mouse-button-control-2.20.2-installer_4zR-Hf1.exe
Size

1.7MB
Sample

240521-m888gsbd35
MD5

e0573ad79c7b7d1f79b0321777123239
SHA1

7b8bc2e9304f29b119cede816b6177c63fb152bb
SHA256

c5c50269e73257c72ae9d49f78fe9b872cf722b36c1eed27980b9ddb82c45da9
SHA512

486dfdde8ef489a079c46015a880e84b0853c3e083ed5a2bbc5ac73194f62948cd907c342efcf08dcf9b882604e5e50a5b14e26605a2f4ec7649820696136335
SSDEEP

24576:i7FUDowAyrTVE3U5F/5tk6t+Ki2T5J4CCRJw9B4dyuHjS3Ep7Wy:iBuZrEUzUKdT5wJw9Bu6

Score

10^/10

Malware Config

Targets

- Target
  
  x-mouse-button-control-2.20.2-installer_4zR-Hf1.exe
- Size
  
  1.7MB
- MD5
  
  e0573ad79c7b7d1f79b0321777123239
- SHA1
  
  7b8bc2e9304f29b119cede816b6177c63fb152bb
- SHA256
  
  c5c50269e73257c72ae9d49f78fe9b872cf722b36c1eed27980b9ddb82c45da9
- SHA512
  
  486dfdde8ef489a079c46015a880e84b0853c3e083ed5a2bbc5ac73194f62948cd907c342efcf08dcf9b882604e5e50a5b14e26605a2f4ec7649820696136335
- SSDEEP
  
  24576:i7FUDowAyrTVE3U5F/5tk6t+Ki2T5J4CCRJw9B4dyuHjS3Ep7Wy:iBuZrEUzUKdT5wJw9Bu6
Score

10^/10

bootkit discovery persistence spyware stealer cobaltstrike backdoor evasion trojan
- Cobalt Strike reflective loader
  Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
- Sets service image path in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Downloads MZ/PE file
- Modifies powershell logging option
  evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2