Overview

overview

10

Static

static

5c10afa23f...39.msi

windows7_x64

10

5c10afa23f...39.msi

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5c10afa23f689af55e3479480f13836b05f64dc2f3edf47b7084f297c5894539

  • Size

    3.1MB

  • Sample

    201111-fkg2z7ef26

  • MD5

    56f97661a171b446d89733cb499082e4

  • SHA1

    feb03f3d2a29d27b56685954fb6b4a253e3da87f

  • SHA256

    5c10afa23f689af55e3479480f13836b05f64dc2f3edf47b7084f297c5894539

  • SHA512

    21b4ceb6ab24477722ba1d214903755eb7fdc5dfe527d690072e56a4b0e308f99e861f13f0b4c7d78fb194a58d428713bce360cb23b853f7646d87c52711107b

Score
10/10
metasploitbackdoorpersistencetrojanvmprotect

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://47.91.237.42:8443/blIF

Targets

    • Target

      5c10afa23f689af55e3479480f13836b05f64dc2f3edf47b7084f297c5894539

    • Size

      3.1MB

    • MD5

      56f97661a171b446d89733cb499082e4

    • SHA1

      feb03f3d2a29d27b56685954fb6b4a253e3da87f

    • SHA256

      5c10afa23f689af55e3479480f13836b05f64dc2f3edf47b7084f297c5894539

    • SHA512

      21b4ceb6ab24477722ba1d214903755eb7fdc5dfe527d690072e56a4b0e308f99e861f13f0b4c7d78fb194a58d428713bce360cb23b853f7646d87c52711107b

    Score
    10/10
    metasploitbackdoorpersistencetrojanvmprotect

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks