metasploit | db6cea7e8d62d3b21efe3b423b48c131e345cb55f168cbe1f142e491bb812747 | Triage™

Login
Reports

Overview

overview

Static

static

3

Kobalc.exe

windows10-2004-x64

Kobalc.exe

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
Kobalc.exe
Size 185KB
Sample260618-rnx2yaaw8t
SHA256 db6cea7e8d62d3b21efe3b423b48c131e345cb55f168cbe1f142e491bb812747
MD5 15717cd327a723820d71900611545917
SHA1 99184ec149d329e98cd3e600cfaba22a2f9a0156
SHA512 a0de435db809e3e79f89411017e244c76145e010c67f894d41e265804c832f5514ac2f31cc9a0c667afa77aaaf3eccecac148279ca5a0feba492b222d5481a49
SSDEEP 3072:LoixrduqW9Goin4lZoD9d16zVfMZ2KKNRdTaB:0W5jOA96xrRd
TLSH
T14004126FE2274321F0D4C776099E4BE0C37819A8AC7AC92535082F9D1C3291F9C3E1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

metasploit backdoor defense_evasion discovery persistence privilege_escalation trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

Kobalc.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

32 signatures

150 seconds

backdoor defense_evasion discovery metasploit persistence privilege_escalation trojan

Behavioral task

behavioral2

Sample

Kobalc.exe

Resource

win11ltsc2024-20260618-en

windows11-ltsc_2024-x64

21 signatures

150 seconds

backdoor defense_evasion discovery metasploit persistence privilege_escalation trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

- Target
  Kobalc.exe
- Size 185KB
- SHA256 db6cea7e8d62d3b21efe3b423b48c131e345cb55f168cbe1f142e491bb812747
- MD5 15717cd327a723820d71900611545917
- SHA1 99184ec149d329e98cd3e600cfaba22a2f9a0156
- SHA512 a0de435db809e3e79f89411017e244c76145e010c67f894d41e265804c832f5514ac2f31cc9a0c667afa77aaaf3eccecac148279ca5a0feba492b222d5481a49
- SSDEEP 3072:LoixrduqW9Goin4lZoD9d16zVfMZ2KKNRdTaB:0W5jOA96xrRd
- TLSH
  T14004126FE2274321F0D4C776099E4BE0C37819A8AC7AC92535082F9D1C3291F9C3E1AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery metasploit persistence privilege_escalation trojan
- Family: MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- Windows security bypass
  defense_evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Looks for VMWare Tools registry key
  defense_evasion
- Modifies Windows Firewall
  defense_evasion
- Deletes itself
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Time Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

backdoordefense_evasiondiscoverymetasploitpersistenceprivilege_escalationtrojan

behavioral2

backdoordefense_evasiondiscoverymetasploitpersistenceprivilege_escalationtrojan

© 2018-2026

Terms | Privacy