Overview

overview

10

Static

static

1069d2ad83...f6.exe

windows7_x64

10

1069d2ad83...f6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1069d2ad83c0264ebf61b490d6385fa9eb678f93dedf165b6863177ea4ac38f6

  • Size

    498KB

  • Sample

    220604-pm43rabebp

  • MD5

    88d16eafa3d80cbc183085f120475998

  • SHA1

    d9898f4b77ed203106fdb6eaf9b83afec20b6022

  • SHA256

    1069d2ad83c0264ebf61b490d6385fa9eb678f93dedf165b6863177ea4ac38f6

  • SHA512

    b2d97d022d6738a08333bbf5b652c9f96ed5198b189b86912689b5a6a1169f7a4444f947e3c286973cd43643617206051d2da07070d72a1b14f2e22a78ad862a

Score
10/10
metasploitbackdoortrojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      1069d2ad83c0264ebf61b490d6385fa9eb678f93dedf165b6863177ea4ac38f6

    • Size

      498KB

    • MD5

      88d16eafa3d80cbc183085f120475998

    • SHA1

      d9898f4b77ed203106fdb6eaf9b83afec20b6022

    • SHA256

      1069d2ad83c0264ebf61b490d6385fa9eb678f93dedf165b6863177ea4ac38f6

    • SHA512

      b2d97d022d6738a08333bbf5b652c9f96ed5198b189b86912689b5a6a1169f7a4444f947e3c286973cd43643617206051d2da07070d72a1b14f2e22a78ad862a

    Score
    10/10
    metasploitbackdoortrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks