General

  • Target

    16834e676f3c8e4de9435cefe2846b50N

  • Size

    9KB

  • Sample

    240908-dh9xnatere

  • MD5

    16834e676f3c8e4de9435cefe2846b50

  • SHA1

    5131573e0cea13c8671750fc2646b3e217a291af

  • SHA256

    080be64f9d322aad325f29c6f90f03f5ea394a24affcdd9b6c2fc834d96e5a6f

  • SHA512

    ac5e99be7d9effbd84cb757bbc73633c3db93a0d2f8cdcc43613181c2231634828784a9f73fa334ca1600470688701414c230a48986847f0e95bf38ec038ade8

  • SSDEEP

    48:q0kV3zU9G4aNVh7XphlhEF57/ncjJZeCOOtJnw2OxPwybOE:vDIKk9Wow20P

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_http

C2

http://192.168.180.11:30000/OxURwBHGbdtrXGpdDfDZhAnmTn19HwUskpnDdjkTd0LbyOQ5q39zk9QyFoqXvOOc8ezjuuk5sy-ze01DxgIhIpwQqNll6uFXkKQsabK330p8YRNL

Targets

    • Target

      16834e676f3c8e4de9435cefe2846b50N

    • Size

      9KB

    • MD5

      16834e676f3c8e4de9435cefe2846b50

    • SHA1

      5131573e0cea13c8671750fc2646b3e217a291af

    • SHA256

      080be64f9d322aad325f29c6f90f03f5ea394a24affcdd9b6c2fc834d96e5a6f

    • SHA512

      ac5e99be7d9effbd84cb757bbc73633c3db93a0d2f8cdcc43613181c2231634828784a9f73fa334ca1600470688701414c230a48986847f0e95bf38ec038ade8

    • SSDEEP

      48:q0kV3zU9G4aNVh7XphlhEF57/ncjJZeCOOtJnw2OxPwybOE:vDIKk9Wow20P

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks