Behavioral task
behavioral1
Sample
bf6.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
bf6.exe
Resource
win10v2004-20230220-en
General
-
Target
bf6.exe
-
Size
7KB
-
MD5
156d7e54a4fa08b4ce92ea0134304e81
-
SHA1
c1710b1a851307f763fa021d68b56abbdf22699b
-
SHA256
d768b60334ed25e798aeeaa51ef64babddc70fa64056e46ec8de2558d8224aeb
-
SHA512
53f0a1259da6f4b0b77387959d879359f670125ace1c0aaaaa012cd5f3ed3307d9d15bc1abed7c10acdda6c63fe93c70a4ea2b01a16b184abe7668e14896cd24
-
SSDEEP
24:eFGStrJ9u0/6oCnZdkBQAVxcLYKLqheNDMSCvOXpmB:is0ZakBQNLYBSD9C2kB
Malware Config
Extracted
metasploit
metasploit_stager
192.153.76.76:443
Signatures
-
Metasploit family
Files
-
bf6.exe.exe windows x64
b4c6fff030479aa3b12625be67bf4914
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
ExitProcess
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.acyd Size: 1024B - Virtual size: 632B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE