Overview

overview

10

Static

static

10

TekDefense.exe

windows7-x64

7

TekDefense.exe

windows10-2004-x64

7

index 2.html

windows7-x64

1

index 2.html

windows10-2004-x64

1

index2 2.html

windows7-x64

1

index2 2.html

windows10-2004-x64

1

index3 2.html

windows7-x64

1

index3 2.html

windows10-2004-x64

1

ransomware.exe

windows7-x64

7

ransomware.exe

windows10-2004-x64

7

tekdefense.dll

windows7-x64

10

tekdefense.dll

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TekDefense.7z

  • Size

    797KB

  • MD5

    c82d09221968ed5704ab50846de38f5b

  • SHA1

    08309adceb9635a1079145478aa0effe3d1eeeaf

  • SHA256

    803eb608ac54661ccf23259c6a8d07fdc26bd83788a661dbd0cf1a08022d4a0f

  • SHA512

    0f97ea615aa8f62f05e880b14b6207b24b6f8a924c5c7464bebb6cb6b6b6ccc7bbfcb381caf951ddf1d4845b6e758b450f4b4ae8a15b6b5abfd2e9e24f56f427

  • SSDEEP

    24576:56n+Kxq0SkvyymIRXjFuY08ub0D0/QgvWcNFK31M:56nZvqymyj68oQgvz/K31M

Score
10/10
upxmetasploit

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://zwned.tekdefense.com:80/JpHZ

Signatures

  • Metasploit family
    metasploit
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

Files

  • TekDefense.7z
    .7z

    Password: infected

  • TekDefense.zip
    .zip

    Password: infected

  • TekDefense.exe
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections

  • ransomware.zip
    .zip

    Password: infected

  • index 2.html
    .html
  • index2 2.html
    .html
  • index3 2.html
  • ransomware.exe
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections

  • tekdefense.dll
    .dll windows x86

    0b7b4c8fba119fc8ba64403e1ce2bcf1


    Headers

    Imports

    Exports

    Sections