Overview

overview

10

Static

static

79e32ed5b8...fc.exe

windows7-x64

10

79e32ed5b8...fc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    79e32ed5b8a2d0bd3511f10172b12c204ef5feecaf1b753d1c438c462b58a8fc

  • Size

    84KB

  • Sample

    220919-b9p1fsbdb5

  • MD5

    d5aa2dbec14a5ca3e5c19cea1a94d0ff

  • SHA1

    f513480226b993cbcd01f04107361b2576d95282

  • SHA256

    79e32ed5b8a2d0bd3511f10172b12c204ef5feecaf1b753d1c438c462b58a8fc

  • SHA512

    6e6f476d155ab9c3a8d3ea9c15d6fb319338ea46949600906620d87951f1f04d2ec7934ac5b8efc80461c1b0d611fac6368482cf4b07b6b96ff58935da0a236d

  • SSDEEP

    1536:rW0uLeM8v/q291NR7HVAQCUwljFf+NW49:rWhLA1NRjVAjtls

Score
10/10
metasploitbackdoorpersistencetrojanupx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      79e32ed5b8a2d0bd3511f10172b12c204ef5feecaf1b753d1c438c462b58a8fc

    • Size

      84KB

    • MD5

      d5aa2dbec14a5ca3e5c19cea1a94d0ff

    • SHA1

      f513480226b993cbcd01f04107361b2576d95282

    • SHA256

      79e32ed5b8a2d0bd3511f10172b12c204ef5feecaf1b753d1c438c462b58a8fc

    • SHA512

      6e6f476d155ab9c3a8d3ea9c15d6fb319338ea46949600906620d87951f1f04d2ec7934ac5b8efc80461c1b0d611fac6368482cf4b07b6b96ff58935da0a236d

    • SSDEEP

      1536:rW0uLeM8v/q291NR7HVAQCUwljFf+NW49:rWhLA1NRjVAjtls

    Score
    10/10
    metasploitbackdoorpersistencetrojanupx

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks