CobIntMalware
- coolpants
CobInt, is a self-developed backdoor of the Cobalt group. The modular tool has capabilities to collect initial intelligence information about the compromised machine and stream video from its desktop. If the operator decides that the system is of interest, the backdoor will download and launch CobaltStrike framework stager. It's CRM mailslot module was also observed being downloaded by ISFB.From MISP Galaxy
Last reported 6 years ago, by Group-IB3 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027”
- T1047Windows Management Instrumentation
“T1047”
- T1204User Execution
“T1204”
- T1548.002Bypass User Account Control
“If the version is 6.3 or older, it uses eventvwr.exe to bypass User Account Control (UAC), if it’s 9.1 or newer – fodhelper.exe will be used for bypassing.”
- T1566.001Spearphishing Attachment
“We observed a large number of phishing campaigns, in most of which the group used spearphishing attachments or links.”
- T1566.002Spearphishing Link
“Spearphishing Link”
What the reports say
3 reports, newest first · the exact sentence from each-
A Shortcut to Compromise: Cobalt Gang phishing campaign“The payload is CobInt stager that will download Cobalt Strike beacon from hxxp://safestaticfirefox.com/uacuxuiaeoerkaryixju.”
-
Group-IB unveils its Graph“The file %Temp%einmrmdmy.exe aka dwm.exe is a CobInt stager, configured to work with the server hxxp://admvmsopp.com/rilruietguadvtoefmuy.”
-
Cobalt Renaissance“This program, classified as CobInt, is a self-developed backdoor of the Cobalt group.”
Indicators in its reports
named in the reports above- swift-customer[.]comin 1 report
- e85a079f9e48216e…139677ec3c9fin 1 report
- 76a5a477927a4b8c…fb62afa41a98in 1 report
- valorleads[.]comin 1 report
- 1fdc309f8ff96ebb…7a91165e0b5fin 1 report
- hxxps://image.isu[.]pub/130729032316-97fbf070197fbde8e88397077c468ab6/jpg/page_1.jpgin 1 report
- image.isu[.]pubin 1 report
- hxxp://safestaticfirefox[.]com/uacuxuiaeoerkaryixjuin 1 report
- safestaticfirefox[.]comin 1 report
- 11.11.11[.]11in 1 report
- 22.22.22[.]22in 1 report
- 33.33.33[.]33in 1 report
- example[.]ruin 1 report
- secure-telemetry[.]netin 1 report
- ukrfreshnews[.]comin 1 report
- unian-search[.]comin 1 report
- vesti-world[.]infoin 1 report
- runewsmeta[.]comin 1 report
- foxnewsmeta[.]bizin 1 report
- sobesednik-meta[.]infoin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.