metasploit | 338c62948d065986b16f3312c3ec0b66549e0d318e582c9c96d94e4aaeed53e1 | Triage

Sharing

General

Target

338c62948d065986b16f3312c3ec0b66549e0d318e582c9c96d94e4aaeed53e1
Size

1.8MB
Sample

240420-spv5eabh9s
MD5

7f456c29190f9c05b1e576f3ff34ede6
SHA1

b89911ba65037b84803a84f99f77be9ebe5749d5
SHA256

338c62948d065986b16f3312c3ec0b66549e0d318e582c9c96d94e4aaeed53e1
SHA512

e4a9c31602477e4d7d1ddb9a4e765eea1bd077f9ead5e86f2452d569e62b02e8e676b1dd55f8a8412c65c897568380ce1607e0f5b9dc84ab65099460d05d041e
SSDEEP

24576:/3vLRdVhZBK8NogWYO09WOGi9JbBodjwC/hR:/3d5ZQ1qxJ+

Score

10^/10

metasploit backdoor discovery spyware stealer trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

1.15.12.73:4567

Targets

- Target
  
  338c62948d065986b16f3312c3ec0b66549e0d318e582c9c96d94e4aaeed53e1
- Size
  
  1.8MB
- MD5
  
  7f456c29190f9c05b1e576f3ff34ede6
- SHA1
  
  b89911ba65037b84803a84f99f77be9ebe5749d5
- SHA256
  
  338c62948d065986b16f3312c3ec0b66549e0d318e582c9c96d94e4aaeed53e1
- SHA512
  
  e4a9c31602477e4d7d1ddb9a4e765eea1bd077f9ead5e86f2452d569e62b02e8e676b1dd55f8a8412c65c897568380ce1607e0f5b9dc84ab65099460d05d041e
- SSDEEP
  
  24576:/3vLRdVhZBK8NogWYO09WOGi9JbBodjwC/hR:/3d5ZQ1qxJ+
Score

10^/10

metasploit backdoor discovery spyware stealer trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Peripheral Device Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

metasploitbackdoordiscoveryspywarestealertrojan

behavioral2

metasploitbackdoordiscoveryspywarestealertrojan