misp:tool="misp-scraper",osint:source-type="blog-post",misp:event-type="collection",tlp:white,misp-galaxy:malpedia="Cobalt Strike",misp-galaxy:banker="Gozi",misp-galaxy:mitre-attack-pattern="DNS - T1071.004",misp-galaxy:mitre-attack-pattern="PowerShell - T1059.001",misp-galaxy:mitre-attack-pattern="JavaScript - T1059.007",misp-galaxy:mitre-attack-pattern="VNC - T1021.005",misp-galaxy:mitre-attack-pattern="Software - T1592.002",misp-galaxy:mitre-attack-pattern="WHOIS - T1596.002",misp-galaxy:mitre-attack-pattern="Tool - T1588.002",misp-galaxy:mitre-malware="Ursnif - S0386",misp-galaxy:mitre-attack-pattern="Asynchronous Procedure Call - T1055.004",misp-galaxy:mitre-attack-pattern="BITS Jobs - T1197",misp-galaxy:mitre-attack-pattern="Compile After Delivery - T1027.004",misp-galaxy:mitre-attack-pattern="Credentials from Password Stores - T1555",misp-galaxy:mitre-attack-pattern="Domain Account - T1087.002",misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482",misp-galaxy:mitre-attack-pattern="Exfiltration Over C2 Channel - T1041",misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001",misp-galaxy:mitre-attack-pattern="Lateral Tool Transfer - T1570",misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002",misp-galaxy:mitre-attack-pattern="Mark-of-the-Web Bypass - T1553.005",misp-galaxy:mitre-attack-pattern="Mshta - T1218.005",misp-galaxy:mitre-attack-pattern="Process Discovery - T1057",misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001",misp-galaxy:mitre-attack-pattern="Remote Access Software - T1219",misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001",misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018",misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082",misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033",misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124",misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005",misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001",misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"