metasploit | f869ba1270b9115f7f0443d194b422bae6ebc3fe900bde26a91b1053f1df82e9 | Triage

Sharing

General

Target

f869ba1270b9115f7f0443d194b422bae6ebc3fe900bde26a91b1053f1df82e9
Size

48KB
Sample

221203-c5hagsbd9s
MD5

ef2b5f7c99394380230739f548646503
SHA1

f2dabc80547c554140b80435f525d11c4dc44d08
SHA256

f869ba1270b9115f7f0443d194b422bae6ebc3fe900bde26a91b1053f1df82e9
SHA512

558ec3eb5803f6f8395fbba9ed467e064868db1d01889f2dd00d39b8c07c47ce2b593bb076917039fcc70a1174ce4e93060c87846b22171a775ed8b2e3e1a811
SSDEEP

768:J/jIC344rlVbNlkp8UQVPgE7sjtxZUCMTlQp+agvmFwWU1zx:9jfrlVBlSmPd7u8CcQ8agm2

Score

10^/10

metasploit backdoor persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

- Target
  
  f869ba1270b9115f7f0443d194b422bae6ebc3fe900bde26a91b1053f1df82e9
- Size
  
  48KB
- MD5
  
  ef2b5f7c99394380230739f548646503
- SHA1
  
  f2dabc80547c554140b80435f525d11c4dc44d08
- SHA256
  
  f869ba1270b9115f7f0443d194b422bae6ebc3fe900bde26a91b1053f1df82e9
- SHA512
  
  558ec3eb5803f6f8395fbba9ed467e064868db1d01889f2dd00d39b8c07c47ce2b593bb076917039fcc70a1174ce4e93060c87846b22171a775ed8b2e3e1a811
- SSDEEP
  
  768:J/jIC344rlVbNlkp8UQVPgE7sjtxZUCMTlQp+agvmFwWU1zx:9jfrlVBlSmPd7u8CcQ8agm2
Score

10^/10

metasploit backdoor persistence trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

metasploitbackdoorpersistencetrojan

behavioral2

metasploitbackdoorpersistencetrojan