General
-
Target
63e6ca46ec31d18ae1824faecda9e912d942b2f12e06347d323090a9ccb420be
-
Size
1.8MB
-
Sample
240606-ef8r9aha63
-
MD5
74aa566f52afe98b26f421663e64cd30
-
SHA1
94138678cd6713f93175d8016340f60b5e1bd5bb
-
SHA256
63e6ca46ec31d18ae1824faecda9e912d942b2f12e06347d323090a9ccb420be
-
SHA512
48cd84f3202950c68571c456832d44ccbcb81daa395ea264939a9bdbda0a0b5d2746e1cbec65d97eaf447ffd292193217165452f899cee191a39f0abdce8cba4
-
SSDEEP
24576:/3vLRdVhZBK8NogWYO09POGi93o/NnIz3VCk36UWdm32y8adTXeDZC1gWCQxRjwW:/3d5ZQ1px3uiDX36U+x25XCQx5
Static task
static1
Behavioral task
behavioral1
Sample
63e6ca46ec31d18ae1824faecda9e912d942b2f12e06347d323090a9ccb420be.exe
Resource
win7-20240508-en
Malware Config
Extracted
metasploit
windows/shell_reverse_tcp
1.15.12.73:4567
Targets
-
-
Target
63e6ca46ec31d18ae1824faecda9e912d942b2f12e06347d323090a9ccb420be
-
Size
1.8MB
-
MD5
74aa566f52afe98b26f421663e64cd30
-
SHA1
94138678cd6713f93175d8016340f60b5e1bd5bb
-
SHA256
63e6ca46ec31d18ae1824faecda9e912d942b2f12e06347d323090a9ccb420be
-
SHA512
48cd84f3202950c68571c456832d44ccbcb81daa395ea264939a9bdbda0a0b5d2746e1cbec65d97eaf447ffd292193217165452f899cee191a39f0abdce8cba4
-
SSDEEP
24576:/3vLRdVhZBK8NogWYO09POGi93o/NnIz3VCk36UWdm32y8adTXeDZC1gWCQxRjwW:/3d5ZQ1px3uiDX36U+x25XCQx5
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-