General
-
Target
0fa77fc3e43ab53920173502b4303b3fe2cdfe67e29d443706189fe8e5bf4cf6
-
Size
170KB
-
Sample
220919-dgrdxsdde9
-
MD5
1b350d822f30776066909a80d8419a93
-
SHA1
650990958bbefdfd2c2d76e2217909d981c44cae
-
SHA256
0fa77fc3e43ab53920173502b4303b3fe2cdfe67e29d443706189fe8e5bf4cf6
-
SHA512
09c306e57649f3db6ebf92ba2d707754bcaa6c6da3aae5af59184094ddf1eabc38260bffe143b5f0b6f8e2923a4ca3fc9658c34d739de79618a68f7c78e42012
-
SSDEEP
3072:t2FIPYVs+NtiUaVOwWsHhvllx1AFs/9fGyFqd7IpmrvWHlXhR:4IPYFti5Oh2hdRlFGyFqRIpmbW9hR
Static task
static1
Behavioral task
behavioral1
Sample
0fa77fc3e43ab53920173502b4303b3fe2cdfe67e29d443706189fe8e5bf4cf6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0fa77fc3e43ab53920173502b4303b3fe2cdfe67e29d443706189fe8e5bf4cf6.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Targets
-
-
Target
0fa77fc3e43ab53920173502b4303b3fe2cdfe67e29d443706189fe8e5bf4cf6
-
Size
170KB
-
MD5
1b350d822f30776066909a80d8419a93
-
SHA1
650990958bbefdfd2c2d76e2217909d981c44cae
-
SHA256
0fa77fc3e43ab53920173502b4303b3fe2cdfe67e29d443706189fe8e5bf4cf6
-
SHA512
09c306e57649f3db6ebf92ba2d707754bcaa6c6da3aae5af59184094ddf1eabc38260bffe143b5f0b6f8e2923a4ca3fc9658c34d739de79618a68f7c78e42012
-
SSDEEP
3072:t2FIPYVs+NtiUaVOwWsHhvllx1AFs/9fGyFqd7IpmrvWHlXhR:4IPYFti5Oh2hdRlFGyFqRIpmbW9hR
Score10/10-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-