General

  • Target

    5e9a225092478d3f2b89a269405e037fcda8fff901442f4d1555012652c6aa44

  • Size

    5KB

  • Sample

    220731-yhvsysdfg2

  • MD5

    0b324c7e60d9a207a834338e026f83c2

  • SHA1

    d6b82a45fb4df63f3bc46c1925d8134dbe7b1419

  • SHA256

    5e9a225092478d3f2b89a269405e037fcda8fff901442f4d1555012652c6aa44

  • SHA512

    15e0f149b26a004d3633a080fceaa4f72ab56180da81df037e6460d2105f0b9aeb7249efd528a6df2e2cb014a706fd122aac0a38982c84f4462563bf2b3637f8

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

79.21.107.93:4444

Targets

    • Target

      5e9a225092478d3f2b89a269405e037fcda8fff901442f4d1555012652c6aa44

    • Size

      5KB

    • MD5

      0b324c7e60d9a207a834338e026f83c2

    • SHA1

      d6b82a45fb4df63f3bc46c1925d8134dbe7b1419

    • SHA256

      5e9a225092478d3f2b89a269405e037fcda8fff901442f4d1555012652c6aa44

    • SHA512

      15e0f149b26a004d3633a080fceaa4f72ab56180da81df037e6460d2105f0b9aeb7249efd528a6df2e2cb014a706fd122aac0a38982c84f4462563bf2b3637f8

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks