General

  • Target

    f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea

  • Size

    568KB

  • Sample

    220127-y7rslahhdp

  • MD5

    8d1c06ccab35c496556b23dc602b62e3

  • SHA1

    33d3b0ec31bfc16dcb1b1ff82550aa17fa4c07c5

  • SHA256

    f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea

  • SHA512

    cd023f57416334ddd537cd1edea94b7efb235fe09584c78c44283cbd57116abe3cb80a6ae2f5e8fa582d291c3f3adac0e1c62abc201ec6c5594647ac83bb51fd

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_http

C2

http://209.239.115.91:443/6OHEJ

Targets

    • Target

      f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea

    • Size

      568KB

    • MD5

      8d1c06ccab35c496556b23dc602b62e3

    • SHA1

      33d3b0ec31bfc16dcb1b1ff82550aa17fa4c07c5

    • SHA256

      f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea

    • SHA512

      cd023f57416334ddd537cd1edea94b7efb235fe09584c78c44283cbd57116abe3cb80a6ae2f5e8fa582d291c3f3adac0e1c62abc201ec6c5594647ac83bb51fd

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Command and Control

Web Service

1
T1102

Tasks