metasploit | 9679cf30209e04d460a0c9a051945f60_NEIKI | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9679cf30209e04d460a0c9a051945f60_NEIKI
Size

6KB
MD5

9679cf30209e04d460a0c9a051945f60
SHA1

701c125b12caadddaf6507abdcf9665d49b8f1c5
SHA256

7c83c839611e6cb5f0d1c0e377fcdb8a53061db7301687fd71e63fed247da6ca
SHA512

7a264f9457ac164237080cc7f381237e198a3e9793f32b16601b583f7792846c9297ab133730cb10c86f74fb00fd67f6b8f21990f208c0869a0a638b2ad90749
SSDEEP

48:6BFeRtDMH/nY3uuPFKog/I+QG9apml5TxJ8bXxOXtrqNifmtCnZqPIZ22s9L5i/F:bD6nbgYPPhkNYcClsp5i/vJwJ2Ay

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

14.128.52.185:443

Signatures

Metasploit family
metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9679cf30209e04d460a0c9a051945f60_NEIKI

Files

9679cf30209e04d460a0c9a051945f60_NEIKI
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\ee252f5d\d484dc57\App_Web_321.aspx.cdcab7d2.gngyih7h.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ