Trojan.Win64.COBALT.RC

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %User Temp%\{Random string of 7–10 characters}.sys

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

Otras modificaciones del sistema

Agrega las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
services\{Random string of 7–10 characters}
ImagePath = %User Temp%\{Random string of 7–10 characters}.sys

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
services\{Random string of 7–10 characters}
Type = 1

Otros detalles

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
services\{Random string of 7–10 characters}

Hace lo siguiente:

• It creates and runs the following services:
  • Service Name: {Random string of 7–10 characters}
  • Image Path: %User Temp%\{Random string of 7–10 characters}.sys
• It requires at least Windows 10 version 1607 Anniversary Update for driver compatibility.
• It enables the Windows privilege that allows the process to load and unload kernel-mode drivers.
• It disables Windows kernel notification callbacks.
• It disables Object Manager callbacks.
• It disables Configuration Manager (Registry) callbacks.
• It disables File System MiniFilter callbacks.
• After its execution, it removes the malicious driver and clears traces of its activity to hide evidence of the infection by performing the following actions:
  • Unloading the driver
  • Deleting registry service entries
  • Removing the driver file from disk

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).