COOKBOX
- First seen
- 2022-03-01 00:00:00
- Malware type
- backdoor
- Profile updated
- 2026-07-07 13:13:22
Targeted industries: government-and-public-sector energy-and-utilities
Targeted regions: country_code:ua
Context
According to CERT-UA, COOKBOX is a PowerShell script that implements the functionality of downloading and executing PowerShell cmdlets. For each affected computer, a unique identifier is calculated using cryptographic transformations (SHA256/MD5 hash functions) based on a combination of computer name and disk serial number, which is transmitted in the “X-Cookie” header of HTTP requests when interacting with the management server. The persistence of the backdoor is ensured by the corresponding key in the Run branch of the operating system (OS) registry, which is created at the stage of the initial infection by a third-party PowerShell script (including the COOKBOX deployer). As a rule, obfuscation elements are used in the program code: chr-character encoding, character replacement (replace()), base64 conversion, GZIP compression.
Reports & references
- socprime.com — Uac 0149 Attack Detection Hackers Launch A Targeted Attack Against The Armed Forces Of Ukraine As Cert Ua Reports (report)
- CERT-UA — 6277849 (report)
- cloudflare.com — Disrupting Flyingyetis Campaign Targeting Ukrainev (report)
- malpedia.caad.fkie.fraunhofer.de — Ps1.Cookbox (report)
- CERT-UA — 6278620 (report)