Overview

overview

10

Static

static

10

618e641017...49.exe

windows7-x64

10

618e641017...49.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    618e641017a7e9e05f8b3725c33842960d81e77a74fcfd59710b563ba643a849

  • Size

    72KB

  • MD5

    c7f615807c1eebbc86f256c6645ae62d

  • SHA1

    6fbd0b4356663aca75813668316e91d661894548

  • SHA256

    618e641017a7e9e05f8b3725c33842960d81e77a74fcfd59710b563ba643a849

  • SHA512

    1377a96b5c1e3aa708232d0ead649c50c8530adcab4b2a65911f7b3162c142683cdd725abed19887257f61a11a593f4e3f184217d3821ff0534d407d1eea84d6

  • SSDEEP

    1536:I/7JqdcTKsHHK3xRXNAXNAtU0NpIjMb+KR0Nc8QsJq39:W7JscTKsHq3NwAHpMe0Nc8QsC9

Score
10/10
metasploit

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_http

C2

http://10.0.2.15:8080/s-LzZqARVMZrS2pKDU4ZsAzR2ydVAWV_iTXh_bLY0yUF3XA9YpQcfHr0PEVHcI927mcahdihLd924j-9SV0oeEzlxPBayKewpxt_eeX2fNLWQIusTgaN--L7mUYK7X39nla1DDeBmfrkb4r4-4txYiuNq896-c7MJMrCqIg_KSwbJLEBs1gk852yDY9CMuh

Signatures

  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Metasploit family
    metasploit
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 618e641017a7e9e05f8b3725c33842960d81e77a74fcfd59710b563ba643a849
    .exe windows:4 windows x86 arch:x86

    481f47bbb2c9c21e108d65f52b04c448


    Headers

    Imports

    Sections