Cobalt Trojan

Posted: March 28, 2006

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	3,872
Threat Level:	2/10
Infected PCs:	5,345

First Seen:	May 5, 2022
Last Seen:	October 16, 2023
OS(es) Affected:	Windows

Cobalt is a backdoor Trojan that uses the threat-emulating features of the Cobalt Strike program for gaining remote control over a PC. Threat actors using Cobalt may be able to collect your data, compromise any network-accessible systems, disable security features or install other threatening software. This threat's campaign is using multiple means of obfuscating its identity, and malware experts recommend updating your anti-malware programs to help them remove Cobalt with optimal accuracy particularly.

A Trojan Emulation Going a Bit Too Far

Threat-modeling software that imitates the features of backdoor Trojans, spyware, and other threats is a valuable tool in the kit of any AV organization or cyber-security researcher, but, if left non-secured, can come with some drawbacks. One cybercrook's spam e-mail campaign is hijacking the ordinarily-legitimate program known as Cobalt Strike, which emulates backdoor payloads, to deliver real attacks to the PCs it infects. At the moment, malware researchers only see messages for this campaign circulating in Russia, using fake documents with Cyrillic text.

These messages exploit a recently-patched RTF document vulnerability that Microsoft has refrained from documenting publicly for seventeen years. Opening the text file, which may be concealed inside of an archive, loads a series of JavaScript and PowerShell scripts that download and install a version of 'Cobalt Strike' automatically, hereafter referred to as Cobalt to differentiate it from the non-malign software. Malware experts are confirming Cobalt's full compatibility with both 32-bit and 64-bit versions of Windows, which the backdoor Trojan carries over from the original software.

Cobalt has its main DLL component injected into PowerShell's hidden, command-line interface, instead of the file writing directly onto the disk. From there, cybercrooks may use Cobalt for conducting any of the commands of Cobalt Strike's 'Beacon' component, which include:

Cobalt may upload files from your PC to a Command & Control or C2 server that the cybercrooks control.
Cobalt also may download files and run them, which includes other forms of threatening software, such as specialized spyware (like a banking Trojan).
Cobalt includes general file system-modifying controls to let threat actors delete, copy, rename or move data.
Cobalt may record your keyboard input (AKA keylogging) to a text output file to collect any information that you type.
Any non-typed data also is vulnerable to theft through a screenshot-capturing feature.

Striking Down an Emulator that's More Real than It Deserve

As a Trojan with a basis in software meant for emulating a highly-invasive range of data-collecting and anti-security payloads, Cobalt offers many advantages to its threat actors. It also avoids many of the weaknesses found in previous 'open-source' families like Utku Sen's Hidden Tear and EDA2, and, in fact, has multiple, built-in features for avoiding conventional AV-based analysis. This threat is stopped most easily just before its infection point, which uses traditional spam e-mails, although the contents of these messages may include custom-crafted elements for some targets, such as banking networks. Microsoft also is providing an Office patch, as of November, to block Cobalt's current installation exploit.

Cobalt subverts many Windows components for minimizing its footprint and users should anticipate few or no symptoms related to most Cobalt infections, including the absence of any individually-identifiable files or memory processes. Any victims should prioritize disabling their network connectivity, which limits Cobalt distribution and cuts off the threat actor's remote control. While malware experts still advise using professional anti-malware products for removing Cobalt, your security software may require updating to detect the threat.

Cobalt Strike is a premium application, and malware experts have yet to identify which threat actors have access to its code. However, Cobalt is, for most cybercrooks, the best of both worlds, showing that the price of 'just' opening a simple document is climbing higher than ever before.

Technical Details

Additional Information

The following URL's were detected:

betaengine.org