Overview

overview

10

Static

static

f9c459824e...6f.dll

windows7_x64

10

f9c459824e...6f.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4915075494477824.zip

  • Size

    254KB

  • Sample

    201123-yfbx1nx2x6

  • MD5

    8f866b181acc87fca7d6680446244c9c

  • SHA1

    523e3df6668c6dbc789e1b0d04f5a821b1c3a59f

  • SHA256

    35c9584bcc96565dc32d60f52c6cdfd7f1518a8d0b699072925fd6a1740fd02a

  • SHA512

    4613fab6ad580de14a657fbd316ff15691d4cbd6c77254866e73a4ea86827c05877d512b9f086057ee2db4bd0079a5ffcaa6a9e655d51b0b89db4b1fefbe91e1

Score
10/10
metasploitbackdoortrojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://tiancaii.com:443/image-directory/br.png

Targets

    • Target

      f9c459824e223d5523ac6edfea7b842cf168ae135045258b04b4760f4002a86f

    • Size

      673KB

    • MD5

      6c6846b436ec85b9179ad77fb585e20c

    • SHA1

      4d75fd0ece50bb305a34db32157da76c7fa1ef1a

    • SHA256

      f9c459824e223d5523ac6edfea7b842cf168ae135045258b04b4760f4002a86f

    • SHA512

      6b02d4f33b6bff9a3cfaa9bf50488d22b8e93fb86071aca82b3b15ca09443b50b80cd64be5a7c7fcc9ba9d2b071d8999b3d6330bcf9f43546bbd39b361b495b5

    Score
    10/10
    metasploitbackdoortrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Suspicious use of NtCreateProcessExOtherParentProcess

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks