Overview

overview

10

Static

static

10

1.exe

windows7-x64

10

2.exe

windows7-x64

10

7007.exe

windows7-x64

10

CoolSong.exe

windows7-x64

1

TheAPPLatest1.0.exe

windows7-x64

4

Unconfirme...94.exe

windows7-x64

ctmouse.exe

windows7-x64

exp.exe

windows7-x64

10

gaybox.exe

windows7-x64

1

goodstuff/runme.exe

windows7-x64

1

goodstuff/runme1.exe

windows7-x64

1

loader.exe

windows7-x64

1

mad.exe

windows7-x64

1

madfuck2.exe

windows7-x64

6

madfuck_fix.exe

windows7-x64

6

memleak.exe

windows7-x64

3

mouse.com

windows7-x64

sd.exe

windows7-x64

vmexp.exe

windows7-x64

10

xp_eos.exe

windows7-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    000.rar

  • Size

    3.9MB

  • MD5

    3060eff2c8c7298bdf2cd042cc6e68f6

  • SHA1

    4f13c0678aa251e413c2791e43c1c26760659fe1

  • SHA256

    e5b655d1c3db4e8cefb3a48f79989f62b9a32b804244c8046cfb5fd58d4b1a83

  • SHA512

    7abeca79a9c15eb6a3edefbf8e73f23eccfb7639807ab2316469b6dc363554b959fb87e9899a3afb9569b4d78026fe14a133f405676432748a522617784b9de5

  • SSDEEP

    98304:iKCd6MfA/e1aD5Wd1OFBaM4c0+FCF+nbn+eoBEc7qOw5x:iKCd+/w+bWM4cL7D+BBt72x

Score
10/10
metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

192.151.157.114:7007

173.208.236.234:7010

192.151.157.114:7010

Signatures

  • Metasploit family
    metasploit
  • Unsigned PE 18 IoCs

    Checks for missing Authenticode signature.

Files

  • 000.rar
    .rar
  • 1.exe
    .exe windows:4 windows x86 arch:x86

    481f47bbb2c9c21e108d65f52b04c448


    Headers

    Imports

    Sections

  • 2.exe
    .exe windows:4 windows x86 arch:x86

    481f47bbb2c9c21e108d65f52b04c448


    Headers

    Imports

    Sections

  • 7007.exe
    .exe windows:4 windows x86 arch:x86

    481f47bbb2c9c21e108d65f52b04c448


    Headers

    Imports

    Sections

  • CoolSong.exe
    .exe windows:4 windows x86 arch:x86

    e7e880a8c204c59275876a4564ab0daa


    Headers

    Imports

    Sections

  • TheAPPLatest1.0.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Unconfirmed 131794.crdownload
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • ctmouse.exe
  • exp.exe
    .exe windows:4 windows x86 arch:x86

    481f47bbb2c9c21e108d65f52b04c448


    Headers

    Imports

    Sections

  • gaybox.exe
    .exe windows:4 windows x86 arch:x86

    e7e880a8c204c59275876a4564ab0daa


    Headers

    Imports

    Sections

  • goodstuff/runme.exe
    .exe windows:4 windows x86 arch:x86

    2c5f2513605e48f2d8ea5440a870cb9e


    Headers

    Imports

    Sections

  • goodstuff/runme1.exe
    .exe windows:4 windows x86 arch:x86

    2c5f2513605e48f2d8ea5440a870cb9e


    Headers

    Imports

    Sections

  • loader.exe
    .exe windows:5 windows x86 arch:x86

    45f34627585db0f5844496accaad2b2a


    Headers

    Imports

    Sections

  • mad.exe
    .exe windows:4 windows x86 arch:x86

    e7e880a8c204c59275876a4564ab0daa


    Headers

    Imports

    Sections

  • mad.wma
  • madfuck2.exe
    .exe windows:4 windows x86 arch:x86

    e7e880a8c204c59275876a4564ab0daa


    Headers

    Imports

    Sections

  • madfuck_fix.exe
    .exe windows:4 windows x86 arch:x86

    e7e880a8c204c59275876a4564ab0daa


    Headers

    Imports

    Sections

  • memleak.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • mouse.com
  • sd.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • vmexp.exe
    .exe windows:4 windows x86 arch:x86

    481f47bbb2c9c21e108d65f52b04c448


    Headers

    Imports

    Sections

  • xp_eos.exe
    .exe windows:5 windows x86 arch:x86

    6126bf368f726a582dbf24f73b62e844


    Headers

    Imports

    Sections