Overview

overview

10

Static

static

8

7282a85e69...b3.exe

windows7-x64

8

7282a85e69...b3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

  • Size

    87KB

  • Sample

    220919-dafc3sdaf8

  • MD5

    1f625fa2de5d1cee01425cf6dd843a96

  • SHA1

    696b3a4cf8da199176bcd3dc4c7f2493d81b001e

  • SHA256

    7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

  • SHA512

    366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

  • SSDEEP

    1536:mmXlt0LYNChwXVpvF4jr4ydBxhjrSmAPSOIXaIhltdqPTeHdjIzHx0evlcFnPqDL:DlCeF04I9ISOIXHhVqPa2zHCPG9e32

Score
10/10
metasploitbackdoortrojanupx

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Targets

    • Target

      7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

    • Size

      87KB

    • MD5

      1f625fa2de5d1cee01425cf6dd843a96

    • SHA1

      696b3a4cf8da199176bcd3dc4c7f2493d81b001e

    • SHA256

      7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

    • SHA512

      366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

    • SSDEEP

      1536:mmXlt0LYNChwXVpvF4jr4ydBxhjrSmAPSOIXaIhltdqPTeHdjIzHx0evlcFnPqDL:DlCeF04I9ISOIXHhVqPa2zHCPG9e32

    Score
    10/10
    upxmetasploitbackdoortrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks