Behavioral task
behavioral1
Sample
sh443.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
sh443.exe
Resource
win10v2004-20220901-en
General
-
Target
sh443.exe.zip
-
Size
1KB
-
MD5
bb4ea58c18063570d1be94d7364629f9
-
SHA1
1fde521f7101029d63639144a2f18b9823927ee2
-
SHA256
a661c6098f22a3a406af3a32819156230ec5877ddf977cdb003acce2f74bcc0f
-
SHA512
80c56233c1ab0cbd1807971ed0c75c6cb1b230f3eb6a4dccc3fe5ecc9e9f195b02168a5e14739eff8aada6b8c4bd50f02ec48f2ee022d96c008e62dc3d2738bd
Malware Config
Extracted
metasploit
metasploit_stager
5.230.72.64:443
Signatures
-
Metasploit family
Files
-
sh443.exe.zip.zip
-
sh443.exe.vir.exe windows x64
b4c6fff030479aa3b12625be67bf4914
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
ExitProcess
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rgqx Size: 1024B - Virtual size: 632B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE