metasploit | 478c9e9e70389ed8e587dfbfb8abb07aed5b9b7a8ee1e471c0ea8a0e79097513 | Triage

Submit
Reports

Overview

overview

Static

static

478c9e9e70...13.exe

windows7_x64

478c9e9e70...13.exe

windows10-2004_x64

Sharing

General

Target

478c9e9e70389ed8e587dfbfb8abb07aed5b9b7a8ee1e471c0ea8a0e79097513
Size

159KB
Sample

220714-g2xcfshgaq
MD5

48acf90968be209c5468707fb70799ae
SHA1

f7704e957e9de6f4199d387ec3b2e862f684cec9
SHA256

478c9e9e70389ed8e587dfbfb8abb07aed5b9b7a8ee1e471c0ea8a0e79097513
SHA512

3cad4dc339051822e66ce0bb21319a602a5ffe5958a4ad622f17a9f1ef8266fd4983160ae1e5ae8b1688f11f3260047138abe4d8c6ca8bd5ca723589e584ef5d

Score

10^/10

metasploit backdoor evasion persistence trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

478c9e9e70389ed8e587dfbfb8abb07aed5b9b7a8ee1e471c0ea8a0e79097513.exe

Resource

win7-20220414-en

metasploit backdoor evasion persistence trojan upx

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

478c9e9e70389ed8e587dfbfb8abb07aed5b9b7a8ee1e471c0ea8a0e79097513.exe

Resource

win10v2004-20220414-en

metasploit backdoor evasion persistence trojan upx

windows10-2004_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

- Target
  
  478c9e9e70389ed8e587dfbfb8abb07aed5b9b7a8ee1e471c0ea8a0e79097513
- Size
  
  159KB
- MD5
  
  48acf90968be209c5468707fb70799ae
- SHA1
  
  f7704e957e9de6f4199d387ec3b2e862f684cec9
- SHA256
  
  478c9e9e70389ed8e587dfbfb8abb07aed5b9b7a8ee1e471c0ea8a0e79097513
- SHA512
  
  3cad4dc339051822e66ce0bb21319a602a5ffe5958a4ad622f17a9f1ef8266fd4983160ae1e5ae8b1688f11f3260047138abe4d8c6ca8bd5ca723589e584ef5d
Score

10^/10

metasploit backdoor evasion persistence trojan upx
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Modifies firewall policy service
  evasion
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Peripheral Device Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

metasploitbackdoorevasionpersistencetrojanupx

behavioral2

metasploitbackdoorevasionpersistencetrojanupx

© 2018-2024

Terms | Privacy