metasploit | 3e6f2bd05396a9f74a3555a52bb4f4dfd40743738863bb0d3dd1bddf690a64c8 | Triage

Sharing

General

Target

3e6f2bd05396a9f74a3555a52bb4f4dfd40743738863bb0d3dd1bddf690a64c8
Size

1.8MB
Sample

240605-nmangafa79
MD5

594df2c06ff57d93a2553680c7130aeb
SHA1

8ed4f709710c13815b1384d5e234b8e69356f25d
SHA256

3e6f2bd05396a9f74a3555a52bb4f4dfd40743738863bb0d3dd1bddf690a64c8
SHA512

4fada444649e63794ba2c37b8a3c4a64c287f986687be22e723092317ccc5c71d649513ac192e5d928b9b55b5ac39a813a294c56ba75eb0d509659990f40c298
SSDEEP

24576:/3vLRdVhZBK8NogWYO09TOGi9JbBodjwC/hR:/3d5ZQ1lxJ+

Score

10^/10

metasploit backdoor discovery spyware stealer trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

1.15.12.73:4567

Targets

- Target
  
  3e6f2bd05396a9f74a3555a52bb4f4dfd40743738863bb0d3dd1bddf690a64c8
- Size
  
  1.8MB
- MD5
  
  594df2c06ff57d93a2553680c7130aeb
- SHA1
  
  8ed4f709710c13815b1384d5e234b8e69356f25d
- SHA256
  
  3e6f2bd05396a9f74a3555a52bb4f4dfd40743738863bb0d3dd1bddf690a64c8
- SHA512
  
  4fada444649e63794ba2c37b8a3c4a64c287f986687be22e723092317ccc5c71d649513ac192e5d928b9b55b5ac39a813a294c56ba75eb0d509659990f40c298
- SSDEEP
  
  24576:/3vLRdVhZBK8NogWYO09TOGi9JbBodjwC/hR:/3d5ZQ1lxJ+
Score

10^/10

metasploit backdoor discovery spyware stealer trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Peripheral Device Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

metasploitbackdoordiscoveryspywarestealertrojan

behavioral2

metasploitbackdoordiscoveryspywarestealertrojan