Behavioral task
behavioral1
Sample
b22419b9178652f5c8f077278c7058408ccd5225ab59ab63f687e94e1c0fa32f.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b22419b9178652f5c8f077278c7058408ccd5225ab59ab63f687e94e1c0fa32f.exe
Resource
win10v2004-20240709-en
General
-
Target
b22419b9178652f5c8f077278c7058408ccd5225ab59ab63f687e94e1c0fa32f.exe
-
Size
7KB
-
MD5
3b9d6188975d47c405ae60aa965b0a84
-
SHA1
9776c147d384dc629422df2c7c025a97b1308d01
-
SHA256
b22419b9178652f5c8f077278c7058408ccd5225ab59ab63f687e94e1c0fa32f
-
SHA512
ea84170da8ee6b890be5f17e3c7f53fbda4731440529025e05d03fe03f2dbb0137ec7f3d0f6e6fa6b0e484935a5a2ed296b080d50f73c8b0adfcc72927c2ea6d
-
SSDEEP
24:eFGStrJ9u0/6VM2LnZd0BQAVYWY+hKZq7eNDMSeXixpmB:is0qX30BQ7+h5SD9eS2B
Malware Config
Extracted
metasploit
metasploit_stager
192.168.202.166:4444
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b22419b9178652f5c8f077278c7058408ccd5225ab59ab63f687e94e1c0fa32f.exe
Files
-
b22419b9178652f5c8f077278c7058408ccd5225ab59ab63f687e94e1c0fa32f.exe.exe windows:4 windows x64 arch:x64
b4c6fff030479aa3b12625be67bf4914
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
ExitProcess
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nswj Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE