General

  • Target

    d483257b41d45b740a07fe40d68cf005b94f8919d21f6ee92e740163c1b076d5

  • Size

    14KB

  • Sample

    220919-m342kshgcr

  • MD5

    f0d81d8bf7e67edce24a325dd8136114

  • SHA1

    a8776ca452863587701d897f7f6a24b723f44339

  • SHA256

    d483257b41d45b740a07fe40d68cf005b94f8919d21f6ee92e740163c1b076d5

  • SHA512

    0a4f2b6d80f62222808e81eccb00d37d0e93f64635a4544c230776470ea80cd981bee8041ba243ada1b765b7649a689eafa033f409e8196d724f2a9e299e50e2

  • SSDEEP

    48:6D640H+VzPiZerMpZytjWeyLhnhIAsYBlnfSJYChHeq0JEI0oqtIzNi:WmHGzq6tjW33XlfSZhsJNcy

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

94.168.12.10:9210

Targets

    • Target

      d483257b41d45b740a07fe40d68cf005b94f8919d21f6ee92e740163c1b076d5

    • Size

      14KB

    • MD5

      f0d81d8bf7e67edce24a325dd8136114

    • SHA1

      a8776ca452863587701d897f7f6a24b723f44339

    • SHA256

      d483257b41d45b740a07fe40d68cf005b94f8919d21f6ee92e740163c1b076d5

    • SHA512

      0a4f2b6d80f62222808e81eccb00d37d0e93f64635a4544c230776470ea80cd981bee8041ba243ada1b765b7649a689eafa033f409e8196d724f2a9e299e50e2

    • SSDEEP

      48:6D640H+VzPiZerMpZytjWeyLhnhIAsYBlnfSJYChHeq0JEI0oqtIzNi:WmHGzq6tjW33XlfSZhsJNcy

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks