Cobalt Trojan

Cobalt is a backdoor Trojan that uses the threat-emulating features of the Cobalt Strike program for gaining remote control over a PC. Threat actors using Cobalt may be able to collect your data, compromise any network-accessible systems, disable security features or install other threatening software. This threat's campaign is using multiple means of obfuscating its identity, and malware experts recommend updating your anti-malware programs to help them remove Cobalt with optimal accuracy particularly.

A Trojan Emulation Going a Bit Too Far

Threat-modeling software that imitates the features of backdoor Trojans, spyware, and other threats is a valuable tool in the kit of any AV organization or cyber-security researcher, but, if left non-secured, can come with some drawbacks. One cybercrook's spam e-mail campaign is hijacking the ordinarily-legitimate program known as Cobalt Strike, which emulates backdoor payloads, to deliver real attacks to the PCs it infects. At the moment, malware researchers only see messages for this campaign circulating in Russia, using fake documents with Cyrillic text.

These messages exploit a recently-patched RTF document vulnerability that Microsoft has refrained from documenting publicly for seventeen years. Opening the text file, which may be concealed inside of an archive, loads a series of JavaScript and PowerShell scripts that download and install a version of 'Cobalt Strike' automatically, hereafter referred to as Cobalt to differentiate it from the non-malign software. Malware experts are confirming Cobalt's full compatibility with both 32-bit and 64-bit versions of Windows, which the backdoor Trojan carries over from the original software.

Cobalt has its main DLL component injected into PowerShell's hidden, command-line interface, instead of the file writing directly onto the disk. From there, cybercrooks may use Cobalt for conducting any of the commands of Cobalt Strike's 'Beacon' component, which include:

• Cobalt may upload files from your PC to a Command & Control or C2 server that the cybercrooks control.
• Cobalt also may download files and run them, which includes other forms of threatening software, such as specialized spyware (like a banking Trojan).
• Cobalt includes general file system-modifying controls to let threat actors delete, copy, rename or move data.
• Cobalt may record your keyboard input (AKA keylogging) to a text output file to collect any information that you type.
• Any non-typed data also is vulnerable to theft through a screenshot-capturing feature.

Striking Down an Emulator that's More Real than It Deserve

As a Trojan with a basis in software meant for emulating a highly-invasive range of data-collecting and anti-security payloads, Cobalt offers many advantages to its threat actors. It also avoids many of the weaknesses found in previous 'open-source' families like Utku Sen's Hidden Tear and EDA2, and, in fact, has multiple, built-in features for avoiding conventional AV-based analysis. This threat is stopped most easily just before its infection point, which uses traditional spam e-mails, although the contents of these messages may include custom-crafted elements for some targets, such as banking networks. Microsoft also is providing an Office patch, as of November, to block Cobalt's current installation exploit.

Cobalt subverts many Windows components for minimizing its footprint and users should anticipate few or no symptoms related to most Cobalt infections, including the absence of any individually-identifiable files or memory processes. Any victims should prioritize disabling their network connectivity, which limits Cobalt distribution and cuts off the threat actor's remote control. While malware experts still advise using professional anti-malware products for removing Cobalt, your security software may require updating to detect the threat.

Cobalt Strike is a premium application, and malware experts have yet to identify which threat actors have access to its code. However, Cobalt is, for most cybercrooks, the best of both worlds, showing that the price of 'just' opening a simple document is climbing higher than ever before.

Technical Details