metasploit

General

Target

a0183ddc59605205f37af101460de5c2.exe
Size

10.3MB
Sample

211120-e79hvsfdb2
MD5

a0183ddc59605205f37af101460de5c2
SHA1

f990eef90be40471bde64df1acddeda15e86947c
SHA256

781824a03b746fbeedba42ceba949da4f93388bfd3c7eae4ab560417fd128a40
SHA512

ed06b26da017d1595811698e313b351a16d11556078a2f81d73169dd92b75e6fcbc3d389458b4fb22db1a1f0ce42558e9b20168ee78fb2eeaa5c77380c158d65

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

media17plus

C2

91.121.67.60:51630

Extracted

Family

socelars

C2

http://www.gianninidesign.com/

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

smokeloader

Version

2020

C2

http://membro.at/upload/

http://jeevanpunetha.com/upload/

http://misipu.cn/upload/

http://zavodooo.ru/upload/

http://targiko.ru/upload/

http://vues3d.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

user2121

C2

135.181.129.119:4805

Targets

- Target
  
  a0183ddc59605205f37af101460de5c2.exe
- Size
  
  10.3MB
- MD5
  
  a0183ddc59605205f37af101460de5c2
- SHA1
  
  f990eef90be40471bde64df1acddeda15e86947c
- SHA256
  
  781824a03b746fbeedba42ceba949da4f93388bfd3c7eae4ab560417fd128a40
- SHA512
  
  ed06b26da017d1595811698e313b351a16d11556078a2f81d73169dd92b75e6fcbc3d389458b4fb22db1a1f0ce42558e9b20168ee78fb2eeaa5c77380c158d65
Score

10^/10

redline socelars media17plus aspackv2 infostealer stealer metasploit smokeloader user2121 backdoor themida trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars Payload
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of SetThreadContext
behavioral1 behavioral2