Overview

overview

10

Static

static

28fd3a1d90...e71.js

windows7_x64

28fd3a1d90...e71.js

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    28fd3a1d9087d7b103b7f6cfca002798b6365fe6ebcc66fa02dbb4a9e6378e71

  • Size

    365KB

  • Sample

    220516-x374cadcb3

  • MD5

    c4e9fc349d5c8b24c0ddb1533de2c16b

  • SHA1

    147e938bd06709b3c20eea4ac461093d573be037

  • SHA256

    28fd3a1d9087d7b103b7f6cfca002798b6365fe6ebcc66fa02dbb4a9e6378e71

  • SHA512

    fd0cf6f434e665aabc91f6095394a08483990c12a0b6ad3a1bd820b740af0ddbc02bc0a2592be429c7488b3cd2889afad8f758b4258009dfe51e9faac76842be

Score
10/10
metasploitbackdoorbootkitpersistencetrojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Targets

    • Target

      28fd3a1d9087d7b103b7f6cfca002798b6365fe6ebcc66fa02dbb4a9e6378e71

    • Size

      365KB

    • MD5

      c4e9fc349d5c8b24c0ddb1533de2c16b

    • SHA1

      147e938bd06709b3c20eea4ac461093d573be037

    • SHA256

      28fd3a1d9087d7b103b7f6cfca002798b6365fe6ebcc66fa02dbb4a9e6378e71

    • SHA512

      fd0cf6f434e665aabc91f6095394a08483990c12a0b6ad3a1bd820b740af0ddbc02bc0a2592be429c7488b3cd2889afad8f758b4258009dfe51e9faac76842be

    Score
    10/10
    metasploitbackdoorbootkitpersistencetrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks