cobaltstrike

General

Target

utweb_installer.exe
Size

1.7MB
Sample

240916-yw8xqsxenb
MD5

adb84780e2db2c3643975b76ad57bba9
SHA1

76d1b85e91f0aa8e322669429c1f638dba807b65
SHA256

52984d792bb0fc6b530a989ef1c8389506fccf669e9a902597c135a42ff201f4
SHA512

94572f68fba6f085b5936fd0827cb6b3ffaa480d9473e26f87122443743aec797f312e73fe6a827db9e645edef06f8a44a27c09d39f354ccf14485fe242322fe
SSDEEP

24576:F7FUDowAyrTVE3U5FtFB5xG7wUTgNUYrT0TWmsMFZ2DzcbIZY4:FBuZrEUHB5xmc7Tl7c14

Score

10^/10

Malware Config

Targets

- Target
  
  utweb_installer.exe
- Size
  
  1.7MB
- MD5
  
  adb84780e2db2c3643975b76ad57bba9
- SHA1
  
  76d1b85e91f0aa8e322669429c1f638dba807b65
- SHA256
  
  52984d792bb0fc6b530a989ef1c8389506fccf669e9a902597c135a42ff201f4
- SHA512
  
  94572f68fba6f085b5936fd0827cb6b3ffaa480d9473e26f87122443743aec797f312e73fe6a827db9e645edef06f8a44a27c09d39f354ccf14485fe242322fe
- SSDEEP
  
  24576:F7FUDowAyrTVE3U5FtFB5xG7wUTgNUYrT0TWmsMFZ2DzcbIZY4:FBuZrEUHB5xmc7Tl7c14
Score

10^/10

cobaltstrike backdoor discovery evasion persistence spyware stealer trojan
- Cobalt Strike reflective loader
  Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Drops file in Drivers directory
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Downloads MZ/PE file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies powershell logging option
  evasion
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2