Overview

overview

10

Static

static

10

56d604f2e7...18.ps1

windows7-x64

10

56d604f2e7...18.ps1

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    56d604f2e739f8daef926c6205b499f1_JaffaCakes118

  • Size

    2KB

  • Sample

    240518-z5alzagb2s

  • MD5

    56d604f2e739f8daef926c6205b499f1

  • SHA1

    175fb8f1d97a95f9fb3361fc1a6e7a22b8920556

  • SHA256

    4543a6366a7a6b8a5e393d505b50cbddcf4b5248a021750904fe92c87986cc47

  • SHA512

    c09cdc9ea7970e631a75d939232f168753527c730880e55874446c4f48452cc61f6de72480be7979cd4c95054448412209d126650fcd93f80c9ce0c2be352b0b

Score
10/10
metasploitbackdoorexecutiontrojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

192.168.119.167:4444

Targets

    • Target

      56d604f2e739f8daef926c6205b499f1_JaffaCakes118

    • Size

      2KB

    • MD5

      56d604f2e739f8daef926c6205b499f1

    • SHA1

      175fb8f1d97a95f9fb3361fc1a6e7a22b8920556

    • SHA256

      4543a6366a7a6b8a5e393d505b50cbddcf4b5248a021750904fe92c87986cc47

    • SHA512

      c09cdc9ea7970e631a75d939232f168753527c730880e55874446c4f48452cc61f6de72480be7979cd4c95054448412209d126650fcd93f80c9ce0c2be352b0b

    Score
    10/10
    metasploitbackdoorexecutiontrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks