CUSTOMIZE COBALT STRIKE BEACON CODE

The file was uploaded to VirusTotal from Malaysia and has no detections in VirusTotal at the time of this writing.Дў94b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc in VirusTotal In this post we will provide a technical analysis of the samples and explain how you can detect and respond to this threat.

CUSTOMIZE COBALT STRIKE BEACON CODE

The sophistication of this threat, its intent to conduct espionage, and the fact that the code hasnвЂ™t been seenВ beforeВ in other attacks, together with the fact that it targets specific entities in the wild, leads us to believeВ that this threat was developed by a skilled threat actor.

The Windows and ELF samples share the same functionalities.

The samples are re-implementations of Cobalt Strike Beacon. The malware isВ fully undetected in VirusTotal at the time of this writing and was uploaded from Malaysia.Д«ased on telemetryВ with collaboration from our partners at McAfee Enterprise ATR, this Linux threat has been active in the wild since August targeting telecom companies, government agencies, IT companies, financial institutions and advisory companies around the world.В Targeting has been limited in scope, suggesting that this malware is used in specific attacks rather than mass spreading.ДЄfter further analysis, we found Windows samples that use the same C2. The stealthy sample uses Cobalt StrikeвЂ™s Command and Control (C2) protocol when communicating to the C2 server and has Remote Access capabilitiesВ such as uploading files, running shell commands and writing to files. In August 2021, we at Intezer discovered a fully undetected ELF implementationВ of Cobalt StrikeвЂ™s beacon, which we named Vermilion Strike. At the time of this writing, there is no official Cobalt Strike version for Linux. Highly targeted with victims including telecommunications, government and financeД¬obalt Strike is a popular red team toolВ for Windows which is also heavily used by threat actors.Has IoC and technical overlaps with previously discovered Windows DLL files.Linux malware is fully undetected by vendors.

Discovered Linux & Windows re-implementation of Cobalt Strike Beacon written from scratch.

Customize cobalt strike beacon