Overview

overview

10

Static

static

3

a1.exe

windows7-x64

10

a1.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a1.exe

  • Size

    17KB

  • Sample

    230808-ntyzmsdh2t

  • MD5

    edc57dd59e395db70a30127c3239abe6

  • SHA1

    956aaaac134ee10677b37ed4090effe1c59a8e6d

  • SHA256

    7ab8ed3cc3032beca624b12e0252b389bd1682def34212b24df5020446960d19

  • SHA512

    74b781499f3652f0b7e2f8816b3ea7416f3ef0d4637aa77bc5d995a4da2c56a102aa180c9463e102483b58ba2017f8df0d465210b6bd5df79dbd7c697f988f50

  • SSDEEP

    384:CEEoLO56ayzcMj+z+XYRpyTc+2M+0yKgwo0YgtwYYwmcoFPptHDA3:VE8O56lcVz+XVYgtwYIcQTHDA3

Score
10/10
metasploitbackdoortrojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

173.212.219.45:5656

Targets

    • Target

      a1.exe

    • Size

      17KB

    • MD5

      edc57dd59e395db70a30127c3239abe6

    • SHA1

      956aaaac134ee10677b37ed4090effe1c59a8e6d

    • SHA256

      7ab8ed3cc3032beca624b12e0252b389bd1682def34212b24df5020446960d19

    • SHA512

      74b781499f3652f0b7e2f8816b3ea7416f3ef0d4637aa77bc5d995a4da2c56a102aa180c9463e102483b58ba2017f8df0d465210b6bd5df79dbd7c697f988f50

    • SSDEEP

      384:CEEoLO56ayzcMj+z+XYRpyTc+2M+0yKgwo0YgtwYYwmcoFPptHDA3:VE8O56lcVz+XVYgtwYIcQTHDA3

    Score
    10/10
    metasploitbackdoortrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks