cobaltstrike

General

Target

anti-porn-15.6.11.23-installer_vAup-U1.exe
Size

1.7MB
Sample

240917-tl37aasakb
MD5

e125716935db5e7bdde6f3a5015d85d6
SHA1

548200e6d77f8caf9838af2bbb1462be82775008
SHA256

678e6579252aa7b3fd2363433015c553e0024ae15696e25ce36aad4fcae7782c
SHA512

71851f6f6b1ed4d79c107456e58dc847d7a84daac0955da44e0065cd02aeab2ec8d06dc123307c6c17b059f61b0123659a59a8ba51f68d27128705239eaf081d
SSDEEP

24576:h7FUDowAyrTVE3U5F/rLuHhCLGKNTv3HSxSip7+CB3GB5zoTiB:hBuZrEUEbmTPdip4fMTi

Score

10^/10

Malware Config

Targets

- Target
  
  anti-porn-15.6.11.23-installer_vAup-U1.exe
- Size
  
  1.7MB
- MD5
  
  e125716935db5e7bdde6f3a5015d85d6
- SHA1
  
  548200e6d77f8caf9838af2bbb1462be82775008
- SHA256
  
  678e6579252aa7b3fd2363433015c553e0024ae15696e25ce36aad4fcae7782c
- SHA512
  
  71851f6f6b1ed4d79c107456e58dc847d7a84daac0955da44e0065cd02aeab2ec8d06dc123307c6c17b059f61b0123659a59a8ba51f68d27128705239eaf081d
- SSDEEP
  
  24576:h7FUDowAyrTVE3U5F/rLuHhCLGKNTv3HSxSip7+CB3GB5zoTiB:hBuZrEUEbmTPdip4fMTi
Score

10^/10

cobaltstrike backdoor credential_access discovery evasion persistence spyware stealer trojan upx
- Cobalt Strike reflective loader
  Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Drops file in Drivers directory
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Downloads MZ/PE file
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies powershell logging option
  evasion
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1