Overview

overview

10

Static

static

10

12ed6d183c...c5.dll

windows7_x64

10

12ed6d183c...c5.dll

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12ed6d183cc130f8a7c33418013a05ffbec817a2981e987ef5931e0e9245d7c5

  • Size

    5KB

  • Sample

    220603-q993ysgee7

  • MD5

    d9337ff3c22d2a4258890fd38c5e7d7f

  • SHA1

    6dae55e6a58b612fedb42ebb73a77f9c4b932e27

  • SHA256

    12ed6d183cc130f8a7c33418013a05ffbec817a2981e987ef5931e0e9245d7c5

  • SHA512

    166d9dd0c11cc8d685868e976014938d1abfbb087485324f720b76002e44250309e618622461b6203ea6470dedec62002bea3bda32f4ebf7ef385c78327315ac

Score
10/10
metasploitbackdoortrojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Targets

    • Target

      12ed6d183cc130f8a7c33418013a05ffbec817a2981e987ef5931e0e9245d7c5

    • Size

      5KB

    • MD5

      d9337ff3c22d2a4258890fd38c5e7d7f

    • SHA1

      6dae55e6a58b612fedb42ebb73a77f9c4b932e27

    • SHA256

      12ed6d183cc130f8a7c33418013a05ffbec817a2981e987ef5931e0e9245d7c5

    • SHA512

      166d9dd0c11cc8d685868e976014938d1abfbb087485324f720b76002e44250309e618622461b6203ea6470dedec62002bea3bda32f4ebf7ef385c78327315ac

    Score
    10/10
    metasploitbackdoortrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Blocklisted process makes network request

    • Use of msiexec (install) with remote resource

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks