Overview

overview

10

Static

static

10

272d3bc9dc...96.ps1

windows7-x64

10

272d3bc9dc...96.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    272d3bc9dc21492428bd30b3e850d1c4fd7f76a6df121a6f14c0e5f1a4b95e96

  • Size

    3KB

  • Sample

    240520-nxtt4aae4x

  • MD5

    5cbd62c9056010b9be5c0dd7e1b06247

  • SHA1

    f75727539f2d3efa6c58101f1f5258905776c68f

  • SHA256

    272d3bc9dc21492428bd30b3e850d1c4fd7f76a6df121a6f14c0e5f1a4b95e96

  • SHA512

    e83ff1f4aa78bd0dfd1806881b4ef1559dc7198ff8af78828121779e9324b0a46463d32649d23cfbb72b66b0dbe775fb4e1b756e1184077ed737a3f62c4519a7

Score
10/10
metasploitbackdoorexecutiontrojan

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

170.187.138.149:48887

Targets

    • Target

      272d3bc9dc21492428bd30b3e850d1c4fd7f76a6df121a6f14c0e5f1a4b95e96

    • Size

      3KB

    • MD5

      5cbd62c9056010b9be5c0dd7e1b06247

    • SHA1

      f75727539f2d3efa6c58101f1f5258905776c68f

    • SHA256

      272d3bc9dc21492428bd30b3e850d1c4fd7f76a6df121a6f14c0e5f1a4b95e96

    • SHA512

      e83ff1f4aa78bd0dfd1806881b4ef1559dc7198ff8af78828121779e9324b0a46463d32649d23cfbb72b66b0dbe775fb4e1b756e1184077ed737a3f62c4519a7

    Score
    10/10
    metasploitbackdoorexecutiontrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks