General

  • Target

    701ab5ca21f1fc72f3ca5df89f3eebf3

  • Size

    476KB

  • Sample

    240123-vphkesdbeq

  • MD5

    701ab5ca21f1fc72f3ca5df89f3eebf3

  • SHA1

    bacb3f2f878f6cd6a9eac0a5a913e7f96f128137

  • SHA256

    8b3ec3995b2b6aa409619c4182dda0c0c9435e07b343405768ab0e9be4010cbf

  • SHA512

    34e9ef678821e2e0d51c9619dda2e3c0445fbbe3eab27fc8cec03c22f26e1fe316ae7f13775a4acc67c119c06b44944fb69f21e08f64ea7eafc5d8c570628912

  • SSDEEP

    12288:aeJg3Stp4Bn+laUoW/6cOce8uhroZPXPQk:jJg3SYd+laUdOce8uV6Qk

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Targets

    • Target

      701ab5ca21f1fc72f3ca5df89f3eebf3

    • Size

      476KB

    • MD5

      701ab5ca21f1fc72f3ca5df89f3eebf3

    • SHA1

      bacb3f2f878f6cd6a9eac0a5a913e7f96f128137

    • SHA256

      8b3ec3995b2b6aa409619c4182dda0c0c9435e07b343405768ab0e9be4010cbf

    • SHA512

      34e9ef678821e2e0d51c9619dda2e3c0445fbbe3eab27fc8cec03c22f26e1fe316ae7f13775a4acc67c119c06b44944fb69f21e08f64ea7eafc5d8c570628912

    • SSDEEP

      12288:aeJg3Stp4Bn+laUoW/6cOce8uhroZPXPQk:jJg3SYd+laUdOce8uV6Qk

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Deletes itself

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks