Talos Cobalt Group July 2018

More_eggs has the capability to gather the IP address from the victim's machine.

Cobalt Group obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4.

More_eggs has the capability to gather the username from the victim's machine.

Cobalt Group has used powershell.exe to download and execute scripts.

Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands. The group has used an exploit toolkit known as Threadkit that launches .bat files.

Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.

Cobalt Group has executed JavaScript scriptlets on the victim's machine.

Cobalt Group deleted the DLL dropper from the victim’s machine to cover their tracks.

More_eggs can remove itself from a system.

More_eggs uses HTTPS for C2.

Cobalt Group has used HTTPS for C2.

Cobalt Group has used DNS tunneling for C2.

More_eggs has the capability to gather the OS version and computer name.

More_eggs can download and launch additional payloads.

Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.

Cobalt Group has sent emails containing malicious links that require users to execute a file or macro to infect the victim machine.

Cobalt Group has sent emails containing malicious attachments that require users to execute a file or macro to infect the victim machine.

Cobalt Group has used the command cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt to bypass AppLocker and launch a malicious script.

Cobalt Group has used regsvr32.exe to execute scripts.

Cobalt Group used msxsl.exe to bypass AppLocker and to invoke Jscript code from an XSL file.

More_eggs can obtain information on installed anti-malware programs.

Cobalt Group has sent malicious Word OLE compound documents to victims.

Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.

Cobalt Group has sent emails with URLs pointing to malicious documents.

Cobalt Group has used the Plink utility to create SSH tunnels.