Overview

overview

10

Static

static

05a01c83fe...69.exe

windows7_x64

3

05a01c83fe...69.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05a01c83fecfb19fbbb054d0a68031cb67fa7b0ee9892b401e6a865de52b3369

  • Size

    131KB

  • Sample

    220510-wc9c2sdgf2

  • MD5

    c4d045529b1a5e090006457607e93f08

  • SHA1

    b81acfced02a80738f8cf6cbd123edd2fc6a5b00

  • SHA256

    05a01c83fecfb19fbbb054d0a68031cb67fa7b0ee9892b401e6a865de52b3369

  • SHA512

    4c8725fe40d459b07a9c7c88f6b0f58347f947fee52eb895eda306041b4411af0a19250087e92cd83352fbddbbd484d251dd8233b6b9872e699a51555685ae03

Score
10/10
metasploitbackdoortrojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_http

C2

http://192.168.1.105:4443/iP5QhJBVvpeYe5l6xy3mEgdW6Zsv9Ekj0-naC4mpoGE1yUoeqHZASgl7zmunvPTgW8MBQJ57mAFAZCNBrgbkoHiVwzn6kkmR4bMAjaW-h1I6z5ScKVmz-s

Targets

    • Target

      05a01c83fecfb19fbbb054d0a68031cb67fa7b0ee9892b401e6a865de52b3369

    • Size

      131KB

    • MD5

      c4d045529b1a5e090006457607e93f08

    • SHA1

      b81acfced02a80738f8cf6cbd123edd2fc6a5b00

    • SHA256

      05a01c83fecfb19fbbb054d0a68031cb67fa7b0ee9892b401e6a865de52b3369

    • SHA512

      4c8725fe40d459b07a9c7c88f6b0f58347f947fee52eb895eda306041b4411af0a19250087e92cd83352fbddbbd484d251dd8233b6b9872e699a51555685ae03

    Score
    10/10
    metasploitbackdoortrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks