metasploit | be5a48fc4d92a5a26da69b562795456d9ef90ec723b4105c4b1ede5b57cb29e6 | Triage

Submit
Reports

Overview

overview

Static

static

3

be5a48fc4d...e6.exe

windows7-x64

be5a48fc4d...e6.exe

windows10-2004-x64

Sharing

General

Target

be5a48fc4d92a5a26da69b562795456d9ef90ec723b4105c4b1ede5b57cb29e6
Size

1.8MB
Sample

240418-bb35eseb96
MD5

4414d2ea457ca79b4734f4d03aa10cff
SHA1

be055cc414a6559eb0b8f6c61aa643ffc3a042fb
SHA256

be5a48fc4d92a5a26da69b562795456d9ef90ec723b4105c4b1ede5b57cb29e6
SHA512

c98808a4e483e2d2401c8dbae6cd62c321e993c85cfa406d4ddc56cef804693bcac8b8dd683f96917084f4eefa61b500c5d983b66f6b0e3c3b11585b28226172
SSDEEP

24576:/3vLRdVhZBK8NogWYO09SOGi9J3YiWdCMJ5QxmjwC/hR:/3d5ZQ1exJIiW0MbQxA

Score

10^/10

metasploit backdoor discovery spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

be5a48fc4d92a5a26da69b562795456d9ef90ec723b4105c4b1ede5b57cb29e6.exe

Resource

win7-20240221-en

metasploit backdoor discovery spyware stealer trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

be5a48fc4d92a5a26da69b562795456d9ef90ec723b4105c4b1ede5b57cb29e6.exe

Resource

win10v2004-20240412-en

metasploit backdoor discovery spyware stealer trojan

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

1.15.12.73:4567

Targets

- Target
  
  be5a48fc4d92a5a26da69b562795456d9ef90ec723b4105c4b1ede5b57cb29e6
- Size
  
  1.8MB
- MD5
  
  4414d2ea457ca79b4734f4d03aa10cff
- SHA1
  
  be055cc414a6559eb0b8f6c61aa643ffc3a042fb
- SHA256
  
  be5a48fc4d92a5a26da69b562795456d9ef90ec723b4105c4b1ede5b57cb29e6
- SHA512
  
  c98808a4e483e2d2401c8dbae6cd62c321e993c85cfa406d4ddc56cef804693bcac8b8dd683f96917084f4eefa61b500c5d983b66f6b0e3c3b11585b28226172
- SSDEEP
  
  24576:/3vLRdVhZBK8NogWYO09SOGi9J3YiWdCMJ5QxmjwC/hR:/3d5ZQ1exJIiW0MbQxA
Score

10^/10

metasploit backdoor discovery spyware stealer trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Peripheral Device Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

metasploitbackdoordiscoveryspywarestealertrojan

behavioral2

metasploitbackdoordiscoveryspywarestealertrojan

© 2018-2024

Terms | Privacy