metasploit | a96ca33176922f199292b5045ee07708847f0a996110e9ae55ae1e328debd2d9 | Triage

Sharing

General

Target

evil.hta
Size

7KB
Sample

240430-vhtdcada97
MD5

3de481e35806a802e48aa129124c5170
SHA1

d36306e46b284cef09ed38eda1b98e47b2738f6e
SHA256

a96ca33176922f199292b5045ee07708847f0a996110e9ae55ae1e328debd2d9
SHA512

0f11ac813c13939bd9239a775e5382a3911d4ff7ca1c9884ded8f859e2852d3f765902dcf32009e379895d68629d42bb9c9cab2ebc55226505b63accaf892e47
SSDEEP

192:WJDJLTVYdNIdjwwFRsDUuCONjDZx+BUFL0gMNXdLrd4tQ3I+X0TJWLlePxohtJ:aNT+/Id3RsIufBJegMhAQFkTgLlePCh/

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://10.0.2.15:4444/CMci

Targets

- Target
  
  evil.hta
- Size
  
  7KB
- MD5
  
  3de481e35806a802e48aa129124c5170
- SHA1
  
  d36306e46b284cef09ed38eda1b98e47b2738f6e
- SHA256
  
  a96ca33176922f199292b5045ee07708847f0a996110e9ae55ae1e328debd2d9
- SHA512
  
  0f11ac813c13939bd9239a775e5382a3911d4ff7ca1c9884ded8f859e2852d3f765902dcf32009e379895d68629d42bb9c9cab2ebc55226505b63accaf892e47
- SSDEEP
  
  192:WJDJLTVYdNIdjwwFRsDUuCONjDZx+BUFL0gMNXdLrd4tQ3I+X0TJWLlePxohtJ:aNT+/Id3RsIufBJegMhAQFkTgLlePCh/
Score

10^/10

metasploit backdoor trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

metasploitbackdoortrojan