General

  • Target

    6c0528b9a370d9524d6f171bd20c7e18

  • Size

    141KB

  • Sample

    240121-b13vyscbhk

  • MD5

    6c0528b9a370d9524d6f171bd20c7e18

  • SHA1

    ccb4624856766f6ad75edb815c46c71536b1f7fc

  • SHA256

    587e434b9ded2723bffe45fe65cbb45d302320ba7b622d6a031d4b1eb3852868

  • SHA512

    e361bfa84b84026e5ca4f5bd25a5624ca78fabbaaeb2ff7630dbc5abd8f9f320c42639153d7aa079e6ffbf376738163ac5f86635f3f9a47ab170a9df9a99d248

  • SSDEEP

    1536:VfXzRQ1zFPut5Uj27noHGkC98gizhpHHDrO07pesEhEUA8Kw78hQL/FvP5iWNXTJ:VeWt5u2TsCwv5dq8y9bNXT3fZCREy0

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      6c0528b9a370d9524d6f171bd20c7e18

    • Size

      141KB

    • MD5

      6c0528b9a370d9524d6f171bd20c7e18

    • SHA1

      ccb4624856766f6ad75edb815c46c71536b1f7fc

    • SHA256

      587e434b9ded2723bffe45fe65cbb45d302320ba7b622d6a031d4b1eb3852868

    • SHA512

      e361bfa84b84026e5ca4f5bd25a5624ca78fabbaaeb2ff7630dbc5abd8f9f320c42639153d7aa079e6ffbf376738163ac5f86635f3f9a47ab170a9df9a99d248

    • SSDEEP

      1536:VfXzRQ1zFPut5Uj27noHGkC98gizhpHHDrO07pesEhEUA8Kw78hQL/FvP5iWNXTJ:VeWt5u2TsCwv5dq8y9bNXT3fZCREy0

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks