metasploit | 49fb5fefd7d211a002d3d2ebd1792c1da9dd395c89f7b9721f9b005c89ce88cb

Sharing

Copy URL Twitter E-mail

General

Target

49fb5fefd7d211a002d3d2ebd1792c1da9dd395c89f7b9721f9b005c89ce88cb
Size

94KB
MD5

6818bc4ea5facab25c45dcc3e0bf7113
SHA1

861a71872a71d05345626c59555845f137a43a97
SHA256

49fb5fefd7d211a002d3d2ebd1792c1da9dd395c89f7b9721f9b005c89ce88cb
SHA512

d954709cb7c49ae1e6e047705dfcd680b880b87a1d43224644367f4e53cd41a6656b0bf0193d8300be4990ef312c3394fd8bb35944f4467195a00fe53a097d1d
SSDEEP

768:fXwwMIIx911qUrlyX1houyqqgD9aONOpcYIq9f:fdMII711Zr0shqNpYI

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

101.88.77.198:6666

Signatures

Metasploit family
metasploit

Files

49fb5fefd7d211a002d3d2ebd1792c1da9dd395c89f7b9721f9b005c89ce88cb
.exe windows x64

60d537a62722e810d0cedc0c67ff8b8a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

Sleep
GetSystemInfo
GetCurrentProcess
CreateEventA
OpenEventA
GetTickCount64
WaitForSingleObject
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
lstrlenA
GetModuleFileNameA
Process32Next
CloseHandle
Process32First
CreateProcessA
CreateToolhelp32Snapshot
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW

user32

CharLowerBuffA
GetForegroundWindow

advapi32

OpenProcessToken
RegCloseKey
RegSetValueExA
RegGetValueA
RegOpenKeyExA
AdjustTokenPrivileges

msvcp140d

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Xlength_error@std@@YAXPEBD@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?uncaught_exceptions@std@@YAHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?width@ios_base@std@@QEAA_J_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

vcruntime140d

__std_type_info_destroy_list
__std_exception_destroy
__std_exception_copy
_CxxThrowException
memcpy
memmove
__std_terminate
memset
__CxxFrameHandler3
__current_exception
__C_specific_handler
__current_exception_context

ucrtbased

__setusermatherr
_seh_filter_exe
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_set_fmode
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
terminate
_set_app_type
_free_dbg
malloc
_callnewh
__stdio_common_vfprintf
_invalid_parameter
_CrtDbgReport
strlen
__acrt_iob_func
system
__p__pgmptr
_mbscmp
strcpy_s
strcmp
_configure_narrow_argv

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 373B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 513B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Files

60d537a62722e810d0cedc0c67ff8b8a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

msvcp140d

vcruntime140d

ucrtbased

Sections

.text Size: 46KB - Virtual size: 46KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 2KB - Virtual size: 3KB

.pdata Size: 3KB - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 6KB

.00cfg Size: 512B - Virtual size: 373B

.rsrc Size: 22KB - Virtual size: 21KB

.reloc Size: 1024B - Virtual size: 513B

.text
Size: 46KB - Virtual size: 46KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 2KB - Virtual size: 3KB

.pdata
Size: 3KB - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 6KB

.00cfg
Size: 512B - Virtual size: 373B

.rsrc
Size: 22KB - Virtual size: 21KB

.reloc
Size: 1024B - Virtual size: 513B