Cobra ransomware a new .NET encryptor — ShadowStackRE
Tags
| attack-pattern: | Data Inhibit System Recovery - T1490 Malware - T1587.001 Malware - T1588.001 Server - T1583.004 Server - T1584.004 Tool - T1588.002 |
Common Information
| Type | Value |
|---|---|
| UUID | ac046bc9-acaa-4341-b6ce-649f6b4b4276 |
| Fingerprint | be88f83e35679e85 |
| Analysis status | DONE |
| Considered CTI value | 0 |
| Text language | |
| Published | June 30, 2024, midnight |
| Added to db | Aug. 31, 2024, 10:56 a.m. |
| Last updated | Nov. 17, 2024, 6:55 p.m. |
| Headline | Cobra Ransomware |
| Title | Cobra ransomware a new .NET encryptor — ShadowStackRE |
| Detected Hints/Tags/Attributes | 68/1/17 |
Source URLs
| Redirection | Url | |
|---|---|---|
| Details | Source | https://www.shadowstackre.com/analysis/cobra |
URL Provider
RSS Feed
| Details | Id | Enabled | Feed title | Url | Added to db |
|---|---|---|---|---|---|
| Details | 434 | ✔ | ShadowStackRE | https://www.shadowstackre.com/analysis?format=rss | 2024-08-30 22:08 |
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 8 | www.coinmama.com |
|
| Details | Domain | 5 | www.bitpanda.com |
|
| Details | Domain | 1 | lnt-corp.com |
|
| Details | Domain | 85 | onionmail.org |
|
| Details | Domain | 1 | lntdeal.com |
|
| Details | 1 | purchase@lnt-corp.com |
||
| Details | 1 | xwolf69@onionmail.org |
||
| Details | 1 | admin@lntdeal.com |
||
| Details | 1 | purchase@lntdeal.com |
||
| Details | File | 1122 | svchost.exe |
|
| Details | File | 2125 | cmd.exe |
|
| Details | File | 1 | read_it_cobra.txt |
|
| Details | File | 291 | user32.dll |
|
| Details | File | 131 | tar.gz |
|
| Details | sha256 | 1 | bf0c353bf4f59db1d33b62589cca64d29c915d3073c86cd04e78f1d28bb65d74 |
|
| Details | Url | 4 | https://www.coinmama.com |
|
| Details | Url | 4 | https://www.bitpanda.com |