Overview

overview

10

Static

static

run.js

windows7-x64

10

run.js

windows10-1703-x64

10

run.js

windows10-2004-x64

10

Resubmissions

16-11-2022 19:55

221116-ym4awscf96 10

23-09-2022 03:49

220923-edfzfsghhm 10

23-09-2022 03:48

220923-ecsxmadae6 10

08-09-2022 02:55

220908-deq1dadde4 10

08-09-2022 01:58

220908-cd6trsdda7 10

06-09-2022 10:03

220906-l3mlvsbac8 10

06-09-2022 05:11

220906-ft86lsfdd9 10

06-09-2022 05:09

220906-ftm85scffl 10

06-09-2022 05:09

220906-fs848afdc5 10

06-09-2022 05:07

220906-fsg1qsfda9 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    run.js

  • Size

    365KB

  • Sample

    220830-ddn5dsbhd4

  • MD5

    c4e9fc349d5c8b24c0ddb1533de2c16b

  • SHA1

    147e938bd06709b3c20eea4ac461093d573be037

  • SHA256

    28fd3a1d9087d7b103b7f6cfca002798b6365fe6ebcc66fa02dbb4a9e6378e71

  • SHA512

    fd0cf6f434e665aabc91f6095394a08483990c12a0b6ad3a1bd820b740af0ddbc02bc0a2592be429c7488b3cd2889afad8f758b4258009dfe51e9faac76842be

  • SSDEEP

    6144:Jnm5mwYxm+DzkzFIDIWCy49ezGywT7PDSzT3enlJ1BJ0exGqkIb1Taha6e2T6Huv:FnaIEWeqWdnlhJ+eHHu+1Qk3C+MAQ

Score
10/10
metasploitbackdoorbootkitpersistencetrojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Targets

    • Target

      run.js

    • Size

      365KB

    • MD5

      c4e9fc349d5c8b24c0ddb1533de2c16b

    • SHA1

      147e938bd06709b3c20eea4ac461093d573be037

    • SHA256

      28fd3a1d9087d7b103b7f6cfca002798b6365fe6ebcc66fa02dbb4a9e6378e71

    • SHA512

      fd0cf6f434e665aabc91f6095394a08483990c12a0b6ad3a1bd820b740af0ddbc02bc0a2592be429c7488b3cd2889afad8f758b4258009dfe51e9faac76842be

    • SSDEEP

      6144:Jnm5mwYxm+DzkzFIDIWCy49ezGywT7PDSzT3enlJ1BJ0exGqkIb1Taha6e2T6Huv:FnaIEWeqWdnlhJ+eHHu+1Qk3C+MAQ

    Score
    10/10
    metasploitbackdoorbootkitpersistencetrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks