Overview

overview

10

Static

static

10

download.exe

windows7-x64

10

download.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    download.exe

  • Size

    4KB

  • Sample

    240607-vkg34acd47

  • MD5

    512c08286e3d66c21987e05f09ce7125

  • SHA1

    5a5970be0883565aeef9ab152713d6a41ac7daf6

  • SHA256

    716b65a42612f32fa410f3365eae3e348b9f046d5678e280f8e448d8c6e7b852

  • SHA512

    b20db24435d54afdbb4f89a307212622739ea9a63bd2c668214f0493e92d38edde0bf59aece36f89f7152a0039ba06169313a7cca0f671c645d00b8a50012cac

  • SSDEEP

    96:pxd6xaXg+9n+O0Kv5jhB5IJuG7XZgD6tYTB9X:LM0dp+BKvhhEuG7peDB1

Score
10/10
metasploitbackdoortrojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/exec

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://20.81.130.178:8080/ransomware.exe

Targets

    • Target

      download.exe

    • Size

      4KB

    • MD5

      512c08286e3d66c21987e05f09ce7125

    • SHA1

      5a5970be0883565aeef9ab152713d6a41ac7daf6

    • SHA256

      716b65a42612f32fa410f3365eae3e348b9f046d5678e280f8e448d8c6e7b852

    • SHA512

      b20db24435d54afdbb4f89a307212622739ea9a63bd2c668214f0493e92d38edde0bf59aece36f89f7152a0039ba06169313a7cca0f671c645d00b8a50012cac

    • SSDEEP

      96:pxd6xaXg+9n+O0Kv5jhB5IJuG7XZgD6tYTB9X:LM0dp+BKvhhEuG7peDB1

    Score
    10/10
    metasploitbackdoortrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks