Overview

overview

10

Static

static

10

0a79157ced...09.ps1

windows7-x64

10

0a79157ced...09.ps1

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a79157ced6caf940a852fa5163f2e09.ps1

  • Size

    2KB

  • Sample

    240521-zgssmshg22

  • MD5

    0a79157ced6caf940a852fa5163f2e09

  • SHA1

    e4e2145e4dabe073e3437425c5eafc098c9cf3fd

  • SHA256

    9fcf01850aba30ee520be8691bd97d9ae58b36ba689fcaace2cc218bb15f54ed

  • SHA512

    0494f068a268671b2c71ea7d3321e1c7715b2781fcea79d9dbbdac0b2c0817c049806c270642e99a7ba666392a22e391d48281957e5f1551fe68dc175392e65e

Score
10/10
metasploitbackdoorexecutiontrojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Targets

    • Target

      0a79157ced6caf940a852fa5163f2e09.ps1

    • Size

      2KB

    • MD5

      0a79157ced6caf940a852fa5163f2e09

    • SHA1

      e4e2145e4dabe073e3437425c5eafc098c9cf3fd

    • SHA256

      9fcf01850aba30ee520be8691bd97d9ae58b36ba689fcaace2cc218bb15f54ed

    • SHA512

      0494f068a268671b2c71ea7d3321e1c7715b2781fcea79d9dbbdac0b2c0817c049806c270642e99a7ba666392a22e391d48281957e5f1551fe68dc175392e65e

    Score
    10/10
    metasploitbackdoorexecutiontrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks