Overview

overview

10

Static

static

1

2024-05-03...er.exe

windows7-x64

10

2024-05-03...er.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    03-05-2024 11:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-03_6d67a3bdd5317d782d550ce7bc4fef46_avoslocker.exe

  • Size

    2.2MB

  • MD5

    6d67a3bdd5317d782d550ce7bc4fef46

  • SHA1

    ab3af9bc1d31a202f3729f5d553d2690a0be5e97

  • SHA256

    557ce31352a4559d90fdcb633b9041b2f2645b53b320b0c8849fb85e9ccf8492

  • SHA512

    1cdd71989cdba9cfecb7caa18cca8634531590e58c9a313596f1cd161abd36f0612bd7e1d745964cde093713128f57e5f2801837a6556afadad6afa2fb56da93

  • SSDEEP

    49152:Wv+BF5f37D5to87s3Kv3mqI6VeOMjUfkptVxIyijdTB:Wv+BFB3X7oMs3Kv3mjUu5SB

Score
10/10
metasploitbackdoortrojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp_dns

C2

192.168.0.5:443

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-03_6d67a3bdd5317d782d550ce7bc4fef46_avoslocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-03_6d67a3bdd5317d782d550ce7bc4fef46_avoslocker.exe"
    1⤵
      PID:2744

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2744-0-0x0000000000400000-0x000000000063F000-memory.dmp
      Filesize

      2.2MB

      Download