metasploit

General

Target

f829068075a66248c618db9c7a7c3bb6_JaffaCakes118
Size

179KB
Sample

240418-rfgd8afc25
MD5

f829068075a66248c618db9c7a7c3bb6
SHA1

1798ab6f4dd48e390b72ff15410631287d72e70a
SHA256

6db5b1e7bda8ab48e5f6cc2fee08ff2c250cde39fa21c938877e50ae5d1b619e
SHA512

17969d65c706d687004c5d1c26dbae38566a41ec28c972e89f8203ecd0b1b1f950a52e660dd63667dd567bc8b06d3b438264161eba63c066c1e515dffc7a4cd1
SSDEEP

3072:N29/K9xCyKtp5y5zd+d47mthmASvNLNcvf6XYlhzxuEaNlv92JiY:kyLA2RNyth/izMSXWt4lv9DY

Score

10^/10

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

- Target
  
  f829068075a66248c618db9c7a7c3bb6_JaffaCakes118
- Size
  
  179KB
- MD5
  
  f829068075a66248c618db9c7a7c3bb6
- SHA1
  
  1798ab6f4dd48e390b72ff15410631287d72e70a
- SHA256
  
  6db5b1e7bda8ab48e5f6cc2fee08ff2c250cde39fa21c938877e50ae5d1b619e
- SHA512
  
  17969d65c706d687004c5d1c26dbae38566a41ec28c972e89f8203ecd0b1b1f950a52e660dd63667dd567bc8b06d3b438264161eba63c066c1e515dffc7a4cd1
- SSDEEP
  
  3072:N29/K9xCyKtp5y5zd+d47mthmASvNLNcvf6XYlhzxuEaNlv92JiY:kyLA2RNyth/izMSXWt4lv9DY
Score

10^/10

metasploit backdoor trojan upx
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

UPX packed file

Maps connected drives based on registry

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2