CobaltStrike RAT

Capable of reconnaissance, phishing, keystroke logging, screenshots, file exfiltration, covert

communication, delivering additional payloads and reporting/logging.  Cobalt
Strike, a
penetration testing toolkit, along with a custom shellcode loader that’s
appeared in several ransomware incidents. The loader is a trojanized,
open-source Tetris game that loads an encrypted shellcode payload
named settings.dat from an internal network. Upon decryption, the payload
revealed itself to be a Cobalt Strike stager that connected back to one of
four servers. Cobalt Strike gives you a post-exploitation agent and covert
channels to emulate a quiet long-term embedded actor in your customer’s
network. Malleable C2 lets you change your network indicators to look like
different malware each time. These tools complement Cobalt Strike’s solid
social engineering process, its robust collaboration capability, and unique
reports designed to aid blue team training. Cobalt Strike is the go-to red team
platform.

Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on
the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to
command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning
and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that
once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the
memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB
named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a
toolkit for developing shellcode loaders, called Artifact Kit.

The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written,
stable, and highly customizable.

Cobalt Strike is a tool that supports Red Teams in attack simulation exercises,
providing a number of techniques that allow a Red Team to execute sophisticated
attacks to compromise a target network, established a bridge head in the network,
and then move laterally to gain additional access to computers, accounts, and,
eventually, data.

While the goal of Cobalt Strike is to provide a framework to test network defences in
order to support the development of effective detection mechanisms and incident
response procedures, the power provided by the tools is not lost on malicious actors
who have copied, modified, and included Cobalt Strike modules in tools they use to
carry out other sophisticated attacks.

In particular, Cobalt Strike components are often used to move laterally after
acquiring an initial foothold in the target network or to enable the execution of other
payloads.
The Vatet loader is publicly documented as used on Windows hosts to execute a
Cobalt Strike Beacon payload, which, in turn, loads the Defray777 in memory and
executes it without leaving any artifacts on the filesystem.

 the Cobalt Strike RAT masquerading as a Google Update, and

had a similar behavior profile (similar usage of TTP) with the
other cases we investigated. These factors led us to attribute all
of these attacks to the same threat actor and operation.
Classified as Backdoor.
Beacon is Cobalt Strike's payload to model advanced attackers. Use Beacon
to egress a network over HTTP, HTTPS, or DNS. You may also limit which
hosts egress a network by controlling peer-to-peer Beacons over Windows
named pipes.

Beacon is flexible and supports asynchronous and interactive communication.

Asynchronous communication is low and slow. Beacon will phone home,
download its tasks, and go to sleep. Interactive communication happens in
real-time.

Beacon's network indicators are malleable. Redefine Beacon's communication

with Cobalt Strike's malleable C2 language. This allows you to cloak Beacon
activity to look like other malware or blend-in as legitimate traffic.

Asynchronous and Interactive Operations

Running Commands
Session Passing
Alternate Parent Processes
Spoof Process Arguments
Blocking DLLs in Child Processes
Upload and Download Files
File System Commands
The Windows Registry
Keystrokes and Screenshots
Manage Post-Exploitation Jobs
SOCKS Proxy
Reverse Pivoting
-