metasploit | c471bb1ceec4c31b544199aeeedc828a035380e9f34377743a85b333536beab0 | Triage

Sharing

General

Target

1PQR32F.exe
Size

72KB
Sample

240418-lpbx7saf6w
MD5

f7349160752e1e836ad3b2325cc58e76
SHA1

f4ab175b5a5384394abe427720f9c476eb9f24fd
SHA256

c471bb1ceec4c31b544199aeeedc828a035380e9f34377743a85b333536beab0
SHA512

7a2f4f787e5d8cb152cc78b01a017a60e94edf4121961f47b1b5f61ce5162cdf838832973329a286f32893708d0e18a3c6a6efe16a51799fac8cce2082e6c047
SSDEEP

1536:I7gSr8tHPIXp2/vaagS87Ing3Mb+KR0Nc8QsJq39:y/eQmvapruke0Nc8QsC9

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

3.86.225.235:53

Targets

- Target
  
  1PQR32F.exe
- Size
  
  72KB
- MD5
  
  f7349160752e1e836ad3b2325cc58e76
- SHA1
  
  f4ab175b5a5384394abe427720f9c476eb9f24fd
- SHA256
  
  c471bb1ceec4c31b544199aeeedc828a035380e9f34377743a85b333536beab0
- SHA512
  
  7a2f4f787e5d8cb152cc78b01a017a60e94edf4121961f47b1b5f61ce5162cdf838832973329a286f32893708d0e18a3c6a6efe16a51799fac8cce2082e6c047
- SSDEEP
  
  1536:I7gSr8tHPIXp2/vaagS87Ing3Mb+KR0Nc8QsJq39:y/eQmvapruke0Nc8QsC9
Score

10^/10

metasploit backdoor trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

metasploitbackdoortrojan

behavioral2

metasploitbackdoortrojan