Morphisec Cobalt Gang Oct 2018

Cobalt Group obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4.

Cobalt Group has added persistence by registering the file name for the next stage malware under HKCU\Environment\UserInitMprLogonScript.

Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands. The group has used an exploit toolkit known as Threadkit that launches .bat files.

Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.

Cobalt Group has executed JavaScript scriptlets on the victim's machine.

Cobalt Group has used public sites such as github.com and sendspace.com to upload files and then download them to victim computers. The group's JavaScript backdoor is also capable of downloading files.

Cobalt Group has used the command cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt to bypass AppLocker and launch a malicious script.

Cobalt Group has used regsvr32.exe to execute scripts.

Cobalt Group used a JavaScript backdoor that is capable of collecting a list of the security solutions installed on the victim's machine.