General

  • Target

    8f7ff900b8a80b21bcbefdd154afc5b28e30e005f6824c118947b3b0c62b306a

  • Size

    31KB

  • Sample

    221128-clwnrsfh65

  • MD5

    e1c7bce27bebad6779d912427e7de890

  • SHA1

    ed6c8fb1028af735231fc8e134096c3447738a0b

  • SHA256

    8f7ff900b8a80b21bcbefdd154afc5b28e30e005f6824c118947b3b0c62b306a

  • SHA512

    a2b3d0dbad07000443d3172e3208e27c43a471990d1bbd5f5fd9d64d9edae50ba3f201a312e616827c62ace068b5e85ee3d79c62ab9f72cc8cf61a297c2a67f9

  • SSDEEP

    768:RY4bUOJNc5fSNDbvLjPnbU81Z8RrJyhp6Bx5CY:RZRN1bvLjnboRr/

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Targets

    • Target

      8f7ff900b8a80b21bcbefdd154afc5b28e30e005f6824c118947b3b0c62b306a

    • Size

      31KB

    • MD5

      e1c7bce27bebad6779d912427e7de890

    • SHA1

      ed6c8fb1028af735231fc8e134096c3447738a0b

    • SHA256

      8f7ff900b8a80b21bcbefdd154afc5b28e30e005f6824c118947b3b0c62b306a

    • SHA512

      a2b3d0dbad07000443d3172e3208e27c43a471990d1bbd5f5fd9d64d9edae50ba3f201a312e616827c62ace068b5e85ee3d79c62ab9f72cc8cf61a297c2a67f9

    • SSDEEP

      768:RY4bUOJNc5fSNDbvLjPnbU81Z8RrJyhp6Bx5CY:RZRN1bvLjnboRr/

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Drops file in Drivers directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks