Overview

overview

10

Static

static

3

62a3565a9b...58.exe

windows7-x64

10

62a3565a9b...58.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    62a3565a9b0fc79edfb5475b437eb1029859550d9891307a546847e6a2c57458

  • Size

    1.8MB

  • Sample

    240525-tm3bdaab3z

  • MD5

    81abc39bf823892542b95743d32852f1

  • SHA1

    260f0d960e16b66a9d5f9063e6aeb8f4fedac7bd

  • SHA256

    62a3565a9b0fc79edfb5475b437eb1029859550d9891307a546847e6a2c57458

  • SHA512

    9ef707eb400e2a0077c46afb2d21be5ff6133b6efce2fcdeeece4b8c9d2392cee975797d35d3f9e123e09d78bb1f079f74e8332a978d5624823dfda50fb617fd

  • SSDEEP

    24576:/3vLRdVhZBK8NogWYO09LOGi9JPnXixUmjkfe4o7AWibjwC/hR:/3d5ZQ1dxJPXkUgWe4o0Win

Score
10/10
metasploitbackdoordiscoveryspywarestealertrojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

1.15.12.73:4567

Targets

    • Target

      62a3565a9b0fc79edfb5475b437eb1029859550d9891307a546847e6a2c57458

    • Size

      1.8MB

    • MD5

      81abc39bf823892542b95743d32852f1

    • SHA1

      260f0d960e16b66a9d5f9063e6aeb8f4fedac7bd

    • SHA256

      62a3565a9b0fc79edfb5475b437eb1029859550d9891307a546847e6a2c57458

    • SHA512

      9ef707eb400e2a0077c46afb2d21be5ff6133b6efce2fcdeeece4b8c9d2392cee975797d35d3f9e123e09d78bb1f079f74e8332a978d5624823dfda50fb617fd

    • SSDEEP

      24576:/3vLRdVhZBK8NogWYO09LOGi9JPnXixUmjkfe4o7AWibjwC/hR:/3d5ZQ1dxJPXkUgWe4o0Win

    Score
    10/10
    metasploitbackdoordiscoveryspywarestealertrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks