metasploit | 107a56ff25c6e6d0d75745b9b5c09ead[.]bin | Triage

Sharing

General

Target

107a56ff25c6e6d0d75745b9b5c09ead.bin
Size

1KB
MD5

bc60fdf0913bcaea898652a939e8c477
SHA1

0274389674679676af19ff99f152c317e1af2856
SHA256

b4996fb006a62b636e51867597bfeb693b332f4403a5dc75b7eb439a71df08f5
SHA512

6e67f3fe9291bfaa66b3aa33620ba1cb5d8821a13154b322f0ddeb26ae84975ffa57d14b4e3476c49af244548bec612e55559a4dfd242db59c7c2c2daa468a60

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

185.236.228.215:4444

Signatures

Metasploit family
metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a827a2dc33fc1f562227bf195274b6905bdf1c49e039c1b86d9d24a74f034d96.exe

Files

107a56ff25c6e6d0d75745b9b5c09ead.bin
.zip

Password: infected
a827a2dc33fc1f562227bf195274b6905bdf1c49e039c1b86d9d24a74f034d96.exe
.exe windows x64

Password: infected

b4c6fff030479aa3b12625be67bf4914

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualAlloc
ExitProcess

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ulof
Size: 1024B - Virtual size: 632B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE