Static

static

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8013616139.zip

  • Size

    134KB

  • MD5

    1d4aa4cd08eb8815531c751d6f1809a9

  • SHA1

    ce5f45163a469cdbe14c01ee401d6803ebb2857a

  • SHA256

    ab45cbc07d7bc35bd40dae8aaf41824dea8cd1175b41bb45b1648a721d6e3c33

  • SHA512

    a2027f49323cc080bdea9083aabcbfaab4ddd23da7f82bfe9251f6a6263fe22a5715b66e07a8c643bcd5882cff2d32edabc88d722a8d53f129c9ba0725e6b674

  • SSDEEP

    3072:TrmLGCY5CwdHHYv5sqzmJuwxmS/xEFPdeGS5FfVSqaLzyLpyhqM:2LGCY51dH4vBmJxPxOPde35FtSTuLTM

Score
10/10
metasploit

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://128.199.6.246/fgt.dll

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

128.199.6.246:3432

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

Files

  • 8013616139.zip
    .zip

    Password: infected

  • 2b1a82e666b8e418cbcb25ca8ddcc7858ac78454956f0296db14cb13e4e73ca2
    .zip

    Password: infected

  • DLL.dll
    .dll windows x86

    Password: infected

    da7a59a5f49c9d3c43022a76c2933a90


    Headers

    Imports

    Sections

  • drc.ps1
  • fg.exe
    .exe windows x86

    Password: infected

    481f47bbb2c9c21e108d65f52b04c448


    Headers

    Imports

    Sections

  • fgt.dll
    .dll windows x86

    Password: infected

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • inj.dll
    .dll windows x86

    Password: infected

    ade5176debf3e13f9afa2c850ca3064e


    Headers

    Imports

    Exports

    Sections

  • inject.dll
    .dll windows x86

    Password: infected

    62a2447a5b08ce184684863ad9b90b89


    Headers

    Imports

    Sections

  • t.exe
    .exe windows x86

    Password: infected

    481f47bbb2c9c21e108d65f52b04c448


    Headers

    Imports

    Sections