metasploit | 96792513d1b34feca69adfe1b6bb979e

General

Target
96792513d1b34feca69adfe1b6bb979e
Size 84KB
Sample240212-g2rf7sgd48
SHA256 b389718b57746faf8bc664ac3ddfa9dd6000c0fc178763ce8ae1683ba42031b7
MD5 96792513d1b34feca69adfe1b6bb979e
SHA1 5ffcc774ecb08df8bfec5ff0aca2bcc0c865f936
SHA512 bafa9caa806dc02c63d67790987c1c2b9c3f5d8fd5d36308985e4c14b572d84d3669e28279e138765f61752e3980ea5069fc611ebd1c075b6c9133affae18dd3
SSDEEP 1536:ESgmLe64SiYh4R9Pz6g0af6ExNSaA5scDsrR2:EtsQpPj1dSaFF2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

192.168.0.87:4321

Signatures

Metasploit family
metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
96792513d1b34feca69adfe1b6bb979e

File Explorer

96792513d1b34feca69adfe1b6bb979e

.exe 84KB

96792513d1b34feca69adfe1b6bb979e

IMPHASH aae33ab4a310f18dc58a55b2fb1857a0
SHA256 b389718b57746faf8bc664ac3ddfa9dd6000c0fc178763ce8ae1683ba42031b7
MD5 96792513d1b34feca69adfe1b6bb979e
SHA1 5ffcc774ecb08df8bfec5ff0aca2bcc0c865f936
SHA512 bafa9caa806dc02c63d67790987c1c2b9c3f5d8fd5d36308985e4c14b572d84d3669e28279e138765f61752e3980ea5069fc611ebd1c075b6c9133affae18dd3
SSDEEP 1536:ESgmLe64SiYh4R9Pz6g0af6ExNSaA5scDsrR2:EtsQpPj1dSaFF2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

26435

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mpr

WNetAddConnection2A WNetCancelConnection2A

kernel32

FillConsoleOutputCharacterA GetConsoleScreenBufferInfo GetStdHandle Sleep GetTimeFormatA GetDateFormatA FileTimeToSystemTime IsBadStringPtrA GetSystemTimeAsFileTime SetConsoleCursorPosition SetConsoleCtrlHandler SetPriorityClass GetCurrentProcess GetComputerNameA GetConsoleMode lstrlenA CreateFileA FileTimeToLocalFileTime LCMapStringA InterlockedDecrement InterlockedIncrement GetLastError WideCharToMultiByte RtlUnwind HeapFree ExitProcess TerminateProcess HeapAlloc ResumeThread CreateThread TlsSetValue ExitThread CloseHandle EnterCriticalSection LeaveCriticalSection GetCommandLineA GetVersion InitializeCriticalSection DeleteCriticalSection GetCPInfo GetACP GetOEMCP MultiByteToWideChar LCMapStringW GetCurrentThreadId TlsAlloc SetLastError TlsGetValue GetModuleHandleA GetModuleFileNameA GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc IsBadWritePtr GetStringTypeA GetStringTypeW UnhandledExceptionFilter FlushFileBuffers WriteFile SetHandleCount GetFileType GetStartupInfoA GetProcAddress FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetUnhandledExceptionFilter IsBadReadPtr IsBadCodePtr SetFilePointer SetStdHandle LoadLibraryA ReadConsoleInputA SetConsoleMode

user32

wsprintfA

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey RegConnectRegistryA

Sharing

General

Malware Config

Extracted

Extracted

Signatures

File Explorer

96792513d1b34feca69adfe1b6bb979e

mpr

kernel32

user32

advapi32

generic