Resubmissions

13-07-2024 05:39

240713-gchg1azfpf 10

13-07-2024 05:35

240713-f98vsaxgjq 10

01-03-2024 08:56

240301-kv1m3seg2v 10

General

  • Target

    HradewMM.posh.ps1

  • Size

    3KB

  • Sample

    240713-f98vsaxgjq

  • MD5

    475971ebaaa5e66900e78a2b14ccdb84

  • SHA1

    2fd5abc165b3cfac4da62573aeed0761fbaf45b9

  • SHA256

    97103a38ca96751430190a2c14bda371fa1753b6ac8c904c3783b151fbafadab

  • SHA512

    c7ccc56e43be8f3eb920fff5697b9d29c5a0c03f1a93a45b05724e4cf96f37a8faa273379fe635b4544250f8d99730996094ab9c073312294fd465ae8cbe0371

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

18.176.183.3:19517

Targets

    • Target

      HradewMM.posh.ps1

    • Size

      3KB

    • MD5

      475971ebaaa5e66900e78a2b14ccdb84

    • SHA1

      2fd5abc165b3cfac4da62573aeed0761fbaf45b9

    • SHA256

      97103a38ca96751430190a2c14bda371fa1753b6ac8c904c3783b151fbafadab

    • SHA512

      c7ccc56e43be8f3eb920fff5697b9d29c5a0c03f1a93a45b05724e4cf96f37a8faa273379fe635b4544250f8d99730996094ab9c073312294fd465ae8cbe0371

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks