metasploit

General

Target

f2173ea887e8059d39e7188c562cbec4_JaffaCakes118
Size

133KB
Sample

240415-2lta3sac68
MD5

f2173ea887e8059d39e7188c562cbec4
SHA1

6c4a7a911ddc7703ec38b6ea84dccce2e71bc6c0
SHA256

55dda01cfd510a816154e2123674bb9b04bafd22b56746193b3a098b43806040
SHA512

59676f8e672b11c61f07f3faa37cb749b8626c968bcfabf99db07515bad790b6635a54d5f2ed44821955206f5528f2f050007ad033fc23d205b4d7adfa09b261
SSDEEP

3072:Kl+yXRopfOEK2/3qHOdctCD9kyf2mg0xv6XlIzyE+4il+vDV:2iO7M3SOdcti9kyuV0ZulIz7+4il+vJ

Score

10^/10

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

- Target
  
  Photo19.JPG_www.tinypic.com
- Size
  
  151KB
- MD5
  
  f9661b5a1d1f85b637f19c988c49d657
- SHA1
  
  1e2e92ea95b4a62134ab60c9752615427da454e6
- SHA256
  
  f5b1c8cb0afde9644af26732e236ceab656b16ea5ae358f43d5fa81d83b0e4f7
- SHA512
  
  3ae0a09d06c90a225aa051dc90237df5ddd3872ef26e6a8ddbef52b5e99a844e13ec3ecf684bdabe869818555ea0febf9c30ac72ac2fd94eaa97e93e05bf885a
- SSDEEP
  
  3072:j2zAHt8gc03EK2/3qHOdctCD9kyR2mg0xv6XlIz0E+4il+vDe:Q037M3SOdcti9ky8V0ZulIzF+4il+v6
Score

10^/10

metasploit backdoor trojan upx
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Checks computer location settings

Deletes itself

Executes dropped EXE

UPX packed file

Maps connected drives based on registry

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2