Overview

overview

10

Static

static

8

2ecd1b370d...1b.exe

windows7_x64

10

2ecd1b370d...1b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2ecd1b370d2c29b27160ca1a8e18df1b

  • Size

    3.4MB

  • Sample

    201117-a6c9kve3mn

  • MD5

    99f86cf700ff068ed4ca2d22d048c454

  • SHA1

    67d36aa210cabc861e41289daab6efd1ddd68298

  • SHA256

    69273edbd99a25f03598491e54f80afbfe1d3b18bdc14cbbf013b087da0e796f

  • SHA512

    cc418790124c5f5564acd7da887b2e8ecf3a425020e76943e27159dcfff737fe5cff6d8a0230744ba0d39c48cbe15e2446d0e8e124e81fb66668f72eb025f9e1

Score
10/10
metasploitbackdoortrojanvmprotect

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://47.91.237.42:8443/blIF

Targets

    • Target

      2ecd1b370d2c29b27160ca1a8e18df1b

    • Size

      3.4MB

    • MD5

      99f86cf700ff068ed4ca2d22d048c454

    • SHA1

      67d36aa210cabc861e41289daab6efd1ddd68298

    • SHA256

      69273edbd99a25f03598491e54f80afbfe1d3b18bdc14cbbf013b087da0e796f

    • SHA512

      cc418790124c5f5564acd7da887b2e8ecf3a425020e76943e27159dcfff737fe5cff6d8a0230744ba0d39c48cbe15e2446d0e8e124e81fb66668f72eb025f9e1

    Score
    10/10
    metasploitbackdoortrojanvmprotect

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks