General

  • Target

    4a5627024710f08bc8f62033e6414221

  • Size

    412KB

  • Sample

    240108-d61znabea7

  • MD5

    4a5627024710f08bc8f62033e6414221

  • SHA1

    7c4085557816e40c0a95949e093562460e7f8652

  • SHA256

    6e828d82cc43dbfbcebc72c6bfa079cbf6da3c3f7fd917d6ba257bda0b011d82

  • SHA512

    1e329f5460f9e8249d93425ce4218454c5e3b625200c41474cb7f85e5561c0784ee5d490a25bc73510d6ef510ddda74c209f75c0958c24e8f8499c1ad572386e

  • SSDEEP

    6144:uwdlYcZu3veqrqAcRijtpIYvolrl9g+ymzOLPrnOKIgkKUM/CoFGR34eTmu0:uTvFRpIDvv1CTLOLvqCgCj6d

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Targets

    • Target

      4a5627024710f08bc8f62033e6414221

    • Size

      412KB

    • MD5

      4a5627024710f08bc8f62033e6414221

    • SHA1

      7c4085557816e40c0a95949e093562460e7f8652

    • SHA256

      6e828d82cc43dbfbcebc72c6bfa079cbf6da3c3f7fd917d6ba257bda0b011d82

    • SHA512

      1e329f5460f9e8249d93425ce4218454c5e3b625200c41474cb7f85e5561c0784ee5d490a25bc73510d6ef510ddda74c209f75c0958c24e8f8499c1ad572386e

    • SSDEEP

      6144:uwdlYcZu3veqrqAcRijtpIYvolrl9g+ymzOLPrnOKIgkKUM/CoFGR34eTmu0:uTvFRpIDvv1CTLOLvqCgCj6d

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks