Overview

overview

10

Static

static

3

f38d258532...18.exe

windows7-x64

10

f38d258532...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f38d258532673cf62200ab2d7dd5268a_JaffaCakes118

  • Size

    222KB

  • Sample

    240416-qaw22scd7v

  • MD5

    f38d258532673cf62200ab2d7dd5268a

  • SHA1

    39bf714b2e9ffb5a8cf534977588b71e35952ec6

  • SHA256

    5edaadd37dd1dd9425dbbbdcd360194fe1f965ae971a5c8165a3effdc25c7e80

  • SHA512

    b2c994c3e6575c0463d4278220f79e29867f37049076e28c97feab5af90eec86a472a0f12945df608d73336121c2ff7b9a0c6b30ba82906c67d7f3fdcedc28cf

  • SSDEEP

    6144:ASOrStDEnqmNpMBN+Mcqfbobx4aRrxyre5HfTLGSa:pOrp/N2h4x4aRYixLba

Score
10/10
metasploitbackdoortrojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Targets

    • Target

      f38d258532673cf62200ab2d7dd5268a_JaffaCakes118

    • Size

      222KB

    • MD5

      f38d258532673cf62200ab2d7dd5268a

    • SHA1

      39bf714b2e9ffb5a8cf534977588b71e35952ec6

    • SHA256

      5edaadd37dd1dd9425dbbbdcd360194fe1f965ae971a5c8165a3effdc25c7e80

    • SHA512

      b2c994c3e6575c0463d4278220f79e29867f37049076e28c97feab5af90eec86a472a0f12945df608d73336121c2ff7b9a0c6b30ba82906c67d7f3fdcedc28cf

    • SSDEEP

      6144:ASOrStDEnqmNpMBN+Mcqfbobx4aRrxyre5HfTLGSa:pOrp/N2h4x4aRYixLba

    Score
    10/10
    metasploitbackdoortrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks