metasploit | fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e | Triage

Submit
Reports

Overview

overview

Static

static

3

fb03667416...2e.exe

windows7-x64

fb03667416...2e.exe

windows10-2004-x64

Sharing

General

Target

fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e
Size

1.8MB
Sample

240601-bwt29ach9z
MD5

1f817572c4266d0768a82c89cfe2b636
SHA1

402669ab421dbf19de3502e0e0c1a31849f4bef4
SHA256

fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e
SHA512

60d9abdb27eaaef381a976a37ac1400dd85fc8dab88f62f0d5d6fdcaca630337a049cf2d36088abfb1cbd146525742713120cb87db6f7481ce345922a4735a21
SSDEEP

24576:/3vLRdVhZBK8NogWYO09zOGi9JbBodjwC/hR:/3d5ZQ1pxJ+

Score

10^/10

metasploit backdoor discovery spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe

Resource

win7-20240221-en

metasploit backdoor discovery spyware stealer trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe

Resource

win10v2004-20240508-en

metasploit backdoor discovery spyware stealer trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

1.15.12.73:4567

Targets

- Target
  
  fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e
- Size
  
  1.8MB
- MD5
  
  1f817572c4266d0768a82c89cfe2b636
- SHA1
  
  402669ab421dbf19de3502e0e0c1a31849f4bef4
- SHA256
  
  fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e
- SHA512
  
  60d9abdb27eaaef381a976a37ac1400dd85fc8dab88f62f0d5d6fdcaca630337a049cf2d36088abfb1cbd146525742713120cb87db6f7481ce345922a4735a21
- SSDEEP
  
  24576:/3vLRdVhZBK8NogWYO09zOGi9JbBodjwC/hR:/3d5ZQ1pxJ+
Score

10^/10

metasploit backdoor discovery spyware stealer trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Peripheral Device Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

metasploitbackdoordiscoveryspywarestealertrojan

behavioral2

metasploitbackdoordiscoveryspywarestealertrojan

© 2018-2024

Terms | Privacy