Overview

overview

10

Static

static

3

a8406bc454...9c.exe

windows7-x64

7

a8406bc454...9c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a8406bc454aa29f2915f2250f0fb07deef0883368fe92d66d7f16154e1b4099c

  • Size

    8.6MB

  • Sample

    230825-jwjwaaaa33

  • MD5

    21e14d78b2e975ff45b46ca7ae2c1d0d

  • SHA1

    2c410b8c217f0df382c959c40c60b5cc4db5a21e

  • SHA256

    a8406bc454aa29f2915f2250f0fb07deef0883368fe92d66d7f16154e1b4099c

  • SHA512

    146082c0d3c9ccbc281af6d7870dafc0350d11b3b63feb60d84e1b6874ce8dfc7bb6fd85b0bd331d834317ebbfc97f9acbcf3ba4a2d037fe7329866393efff78

  • SSDEEP

    196608:SpdzUjpRxv8ZkE3dQmR8dA6ly8Qnf2ODjMnGydSRWPG4N1fAxk:4oVR1qkE3dQJl6F3MnG3RWPGy1Ck

Score
10/10
metasploitbackdoorpyinstallertrojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_http

C2

http://192.168.162.128:4444/eUVX8n6xWZSU_pX_8BbViAVfxO3LQlVXkotMNfxK93xuMXsLL_9gj9qFPU5DAIQqSVGVjgeTQtci-28yO_H64nPF2kJYBqMx_dsMMv9QzKAJzbv8W99o5tkmTAYoWqsdjaC7o0mNIOnylO2qc5KnCOnLr04rL6IuV3j7kXTtW6P3YWkPL1MHtt5e1wRu66tXa7syvWYA_lyTl-JCJM54TudezJjxYeNrbbL3

Targets

    • Target

      a8406bc454aa29f2915f2250f0fb07deef0883368fe92d66d7f16154e1b4099c

    • Size

      8.6MB

    • MD5

      21e14d78b2e975ff45b46ca7ae2c1d0d

    • SHA1

      2c410b8c217f0df382c959c40c60b5cc4db5a21e

    • SHA256

      a8406bc454aa29f2915f2250f0fb07deef0883368fe92d66d7f16154e1b4099c

    • SHA512

      146082c0d3c9ccbc281af6d7870dafc0350d11b3b63feb60d84e1b6874ce8dfc7bb6fd85b0bd331d834317ebbfc97f9acbcf3ba4a2d037fe7329866393efff78

    • SSDEEP

      196608:SpdzUjpRxv8ZkE3dQmR8dA6ly8Qnf2ODjMnGydSRWPG4N1fAxk:4oVR1qkE3dQJl6F3MnG3RWPGy1Ck

    Score
    10/10
    metasploitbackdoortrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks