General

  • Target

    d6fb0b91a5670afb56515043befddd3ff051b819875df5c27aab2eedba6d02a3

  • Size

    45KB

  • Sample

    220511-rjgt6aheg2

  • MD5

    c19a391ccba03ada3ba06959c110f0a2

  • SHA1

    e7e6352cc0757722fec7c210d5b6686811506e05

  • SHA256

    d6fb0b91a5670afb56515043befddd3ff051b819875df5c27aab2eedba6d02a3

  • SHA512

    92a105ab421c5f0c3a5c8d98d0890898c6d4916810cb0532998eb0eec733c63ad7a8a90910a94d656811acf3e21852471ffa1ef6625c21b7647963a9ed92b95e

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

1.1.1.1:443

Targets

    • Target

      d6fb0b91a5670afb56515043befddd3ff051b819875df5c27aab2eedba6d02a3

    • Size

      45KB

    • MD5

      c19a391ccba03ada3ba06959c110f0a2

    • SHA1

      e7e6352cc0757722fec7c210d5b6686811506e05

    • SHA256

      d6fb0b91a5670afb56515043befddd3ff051b819875df5c27aab2eedba6d02a3

    • SHA512

      92a105ab421c5f0c3a5c8d98d0890898c6d4916810cb0532998eb0eec733c63ad7a8a90910a94d656811acf3e21852471ffa1ef6625c21b7647963a9ed92b95e

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • suricata: ET MALWARE Win32/Suspected Reverse Shell Connection

      suricata: ET MALWARE Win32/Suspected Reverse Shell Connection

MITRE ATT&CK Matrix

Tasks