Overview

overview

10

Static

static

7

c2b8235208...0b.exe

windows7-x64

10

c2b8235208...0b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c2b823520899d08e1264099b4b4a0fd8c7cefd7f60e2bf856205989612c8600b

  • Size

    2.6MB

  • Sample

    230328-r5te3sdc5v

  • MD5

    04e405285b93d66d1703790fabe401af

  • SHA1

    e695314f80c03370afdf53facdb0d00c63073484

  • SHA256

    c2b823520899d08e1264099b4b4a0fd8c7cefd7f60e2bf856205989612c8600b

  • SHA512

    ed139a59a20ba0740e5a56bb85ab1eb0d4c61d2c32c3173e2c09e9706b42f73c5f59867e64f238184da4d4db17926e2b95fd793a248a37efb6b73e16a153a89d

  • SSDEEP

    49152:RMSHs5GfB/1mzNHg1Dhk9ygIRa1SFGslLLySTCH3YJspLGBqDDcMAj/P776u0X3I:VM5GfB/1mzoeijlPyS0YJspXfxI/zL0W

Score
10/10
metasploitbackdoortrojanupx

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

172.18.40.43:80

Targets

    • Target

      c2b823520899d08e1264099b4b4a0fd8c7cefd7f60e2bf856205989612c8600b

    • Size

      2.6MB

    • MD5

      04e405285b93d66d1703790fabe401af

    • SHA1

      e695314f80c03370afdf53facdb0d00c63073484

    • SHA256

      c2b823520899d08e1264099b4b4a0fd8c7cefd7f60e2bf856205989612c8600b

    • SHA512

      ed139a59a20ba0740e5a56bb85ab1eb0d4c61d2c32c3173e2c09e9706b42f73c5f59867e64f238184da4d4db17926e2b95fd793a248a37efb6b73e16a153a89d

    • SSDEEP

      49152:RMSHs5GfB/1mzNHg1Dhk9ygIRa1SFGslLLySTCH3YJspLGBqDDcMAj/P776u0X3I:VM5GfB/1mzoeijlPyS0YJspXfxI/zL0W

    Score
    10/10
    metasploitbackdoortrojanupx

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks