General

  • Target

    6f6212d1d7c84744d75d5088e44e69df

  • Size

    148KB

  • Sample

    240122-l26y4secb8

  • MD5

    6f6212d1d7c84744d75d5088e44e69df

  • SHA1

    a9f6b12f7d03035ef3430237a90e1498299961df

  • SHA256

    7d62c19eeaa3699be5bb9c149cb23364a57dc9171446019c4ae048dadb27067f

  • SHA512

    fc5e885ae165987cdc37c5e975ec926e26ba5878184d023e51f313bc270d5d792936c907f20e1e269234d54c9d14b98f75e0413b33a7a252752cdcb2e288af77

  • SSDEEP

    3072:CLSoKj0pt1YOo6EwBj5qJ/OjvZw9eQWqM:JoKyYOoz9J/OjRXQTM

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      6f6212d1d7c84744d75d5088e44e69df

    • Size

      148KB

    • MD5

      6f6212d1d7c84744d75d5088e44e69df

    • SHA1

      a9f6b12f7d03035ef3430237a90e1498299961df

    • SHA256

      7d62c19eeaa3699be5bb9c149cb23364a57dc9171446019c4ae048dadb27067f

    • SHA512

      fc5e885ae165987cdc37c5e975ec926e26ba5878184d023e51f313bc270d5d792936c907f20e1e269234d54c9d14b98f75e0413b33a7a252752cdcb2e288af77

    • SSDEEP

      3072:CLSoKj0pt1YOo6EwBj5qJ/OjvZw9eQWqM:JoKyYOoz9J/OjRXQTM

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Adds policy Run key to start application

    • Executes dropped EXE

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks