Overview

overview

10

Static

static

10

58172dca11...8a.dll

windows7-x64

10

58172dca11...8a.dll

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    58172dca112b9ac8ab686a2b65205a0618fecd85a227b9f271ffc907f863208a

  • Size

    14KB

  • Sample

    220724-tzv3tsagd3

  • MD5

    4a35670f74dedc80a63800b7a6359325

  • SHA1

    a3e091ce807da2572fba42385330c72f99272548

  • SHA256

    58172dca112b9ac8ab686a2b65205a0618fecd85a227b9f271ffc907f863208a

  • SHA512

    0bc530960e7e8e61d392cc8ea4c35ea555eb51f15becb0ed8a4d9cc37c39a5b632d2a78a4f96f5e792216609e7ddcabfb3f99bc3150cebfbdfff95bf36627c6f

Score
10/10
metasploitbackdoortrojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://88.190.215.7:443/aWn6

Targets

    • Target

      58172dca112b9ac8ab686a2b65205a0618fecd85a227b9f271ffc907f863208a

    • Size

      14KB

    • MD5

      4a35670f74dedc80a63800b7a6359325

    • SHA1

      a3e091ce807da2572fba42385330c72f99272548

    • SHA256

      58172dca112b9ac8ab686a2b65205a0618fecd85a227b9f271ffc907f863208a

    • SHA512

      0bc530960e7e8e61d392cc8ea4c35ea555eb51f15becb0ed8a4d9cc37c39a5b632d2a78a4f96f5e792216609e7ddcabfb3f99bc3150cebfbdfff95bf36627c6f

    Score
    10/10
    metasploitbackdoortrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks