Overview

overview

10

Static

static

10

who.exe

windows7-x64

10

who.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    who.exe

  • Size

    72KB

  • MD5

    0e24d1f539bf9d28190f941c3a636182

  • SHA1

    9b57ecc68e07c805dec1ce8572384afd20651ded

  • SHA256

    5d6813210d1fc9faa6c25a314dbdbb877240b01282f46c6df70d0de163bc2ea6

  • SHA512

    83a2e6f8d1a33f5d5b07bc8e1d4920f2de7cb02061d1d7a708406d1b36c935178d497b64de69779bda49575017906b99a3c6a53ab85ed3f29e7f361fee34a4d0

  • SSDEEP

    1536:I2BYudlg3ygSDXI72MB9IZWUKuMb+KR0Nc8QsJq39:mygzR9Abe0Nc8QsC9

Score
10/10
metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

3.13.191.225:15095

Signatures

  • Metasploit family
    metasploit
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • who.exe
    .exe windows:4 windows x86 arch:x86

    Password: hashthis

    481f47bbb2c9c21e108d65f52b04c448


    Headers

    Imports

    Sections