General

  • Target

    http://51.79.49,174/

  • Sample

    230609-tp6ftacf25

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

51.79.49.174:443

Targets

    • Target

      http://51.79.49,174/

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v6

Tasks