General
-
Target
110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639
-
Size
89KB
-
Sample
220604-mb9srabcg4
-
MD5
00f3c5e9de28495de0aeba766e905b7d
-
SHA1
da6e3dc9163fb2626aa5c514c99925420f05eb82
-
SHA256
110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639
-
SHA512
011316f4ff28f0841823dd61af6ece96de33007cbe679f89deb917f96c8b17d8fd8e01733c2a44d4b536cdc5bb7e82d1c3a9ee22fa7d6dc4066e76ff9ef36967
Static task
static1
Behavioral task
behavioral1
Sample
110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Targets
-
-
Target
110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639
-
Size
89KB
-
MD5
00f3c5e9de28495de0aeba766e905b7d
-
SHA1
da6e3dc9163fb2626aa5c514c99925420f05eb82
-
SHA256
110669939b529f2b854832b4bcdcc2f12018bf4c1b8918c101b383ca0a2ef639
-
SHA512
011316f4ff28f0841823dd61af6ece96de33007cbe679f89deb917f96c8b17d8fd8e01733c2a44d4b536cdc5bb7e82d1c3a9ee22fa7d6dc4066e76ff9ef36967
Score10/10-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-