Overview

overview

10

Static

static

5

f33be23c32...18.exe

windows7-x64

10

f33be23c32...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f33be23c32dd6fd5c0a4e83ddf60d52e_JaffaCakes118

  • Size

    767KB

  • Sample

    240416-lvnh7aeg88

  • MD5

    f33be23c32dd6fd5c0a4e83ddf60d52e

  • SHA1

    84634e72f98c11bde6f29931bb5fded021e598e8

  • SHA256

    949e52ef1187b9145c0606367c4e51f4c11460f1000edb4fca9787e1a025db2c

  • SHA512

    8dc316539627dedfd2e2002758d635e09ee029a767e76196785b4fe3ccc8eab7b64b754c3478484fe4ce693e77526d3256c4b3b79b3237812988dfdc34b9376c

  • SSDEEP

    12288:chkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcbNRX5c28whhZME:URmJkcoQricOIQxiZY1WNRXP8wnZME

Score
10/10
metasploitbackdoortrojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

192.168.1.105:4444

Targets

    • Target

      f33be23c32dd6fd5c0a4e83ddf60d52e_JaffaCakes118

    • Size

      767KB

    • MD5

      f33be23c32dd6fd5c0a4e83ddf60d52e

    • SHA1

      84634e72f98c11bde6f29931bb5fded021e598e8

    • SHA256

      949e52ef1187b9145c0606367c4e51f4c11460f1000edb4fca9787e1a025db2c

    • SHA512

      8dc316539627dedfd2e2002758d635e09ee029a767e76196785b4fe3ccc8eab7b64b754c3478484fe4ce693e77526d3256c4b3b79b3237812988dfdc34b9376c

    • SSDEEP

      12288:chkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcbNRX5c28whhZME:URmJkcoQricOIQxiZY1WNRXP8wnZME

    Score
    10/10
    metasploitbackdoortrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks