Hidden Cobra

Archived

Hidden Cobra is an APT hacking group mostly targeting media organizations, aerospace, financial and critical infrastructure across the globe. The malware, Hidden Cobra uses, are Remote Access Trojan (RAT) called Joanap and Server Message Block (SMB) worm called Brambul. With this integration, Logpoint can fully extract and correlate the Hidden Cobra events and at the same time combine the results with observations from other systems. The key analytical components of the integration enable users to normalize data from the specified source and view statistics for Hidden Cobra.

Release Details

Version: 3.0.0

Release date: June 05, 2018

Supported On: Logpoint v5.0.0 and later

SHA 256: eb10315ba6844aaa59783026532be00448f0bf9bf6a2ae776aea73fd4ba98dfe

Download

Package Details

Dashboard Package
- LP_Hidden Cobra
Alert Packages
- LP_Hidden Cobra Emails Sent to Attacker
- LP_Hidden Cobra Vulnerable Sources
- LP_Hidden Cobra Connection to Malicious Destination
- LP_Incapsula Countries in Excessive Blocked List
- LP_Hidden Cobra Affected Host
KB List
- HIDDEN_COBRA_HASH
- HIDDEN_COBRA_EMAIL
- HIDDEN_COBRA_CVE
- HIDDEN_COBRA_FILE
- HIDDEN_COBRA_IP

Installation

To install Hidden Cobra:

Download the .pak file from the Download link above.
Add the required Hidden Cobra as a device in Logpoint.
Create a collection policy with Syslog, the normalization, and a relevant repository.
Assign the policy to the device.
Add the dashboard.

Screenshots

Log Source Requirements

Windows Server/Integrity Scanner
- To detect malicious file installation and malware-infected hosts.
Mail Server
- To detect any emails sent to the malicious address.
Firewall
- To detect the connection to and from the malicious listed sources.
Vulnerability Management
- To detect hosts vulnerable to malware.

Support

If you have any questions or require assistance, create a support ticket..