General

  • Target

    20a1a86fd4454d5b76d5b6e5433e792bb703ba5ca7c72e150d6e59db82761484

  • Size

    44KB

  • Sample

    240912-zxxfrsvcml

  • MD5

    a3fd69807a69f1b3547ae1333074818f

  • SHA1

    b302683418ffe720430ca1107f53cb3bd0d273ed

  • SHA256

    20a1a86fd4454d5b76d5b6e5433e792bb703ba5ca7c72e150d6e59db82761484

  • SHA512

    04831d55dc7affab74f8b3bb8198aca3ad53fd39171f322394c8f414b2c6180c8d89efa4e053803471ebd5ba690d5ee966ad48d7c8e1d79b8f32050064c4fa48

  • SSDEEP

    768:8P1k3hbdlylKsgqopeJBWhZFGkE+cL2NdAJYstYa6PiRDkp3ZiAk4cD3tT:o1k3hbdlylKsgqopeJBWhZFGkE+cL2Nc

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_http

C2

http://192.168.1.1:999/UBACbxCvMQYL6ArpVZYZpgR-yH-56

Targets

    • Target

      20a1a86fd4454d5b76d5b6e5433e792bb703ba5ca7c72e150d6e59db82761484

    • Size

      44KB

    • MD5

      a3fd69807a69f1b3547ae1333074818f

    • SHA1

      b302683418ffe720430ca1107f53cb3bd0d273ed

    • SHA256

      20a1a86fd4454d5b76d5b6e5433e792bb703ba5ca7c72e150d6e59db82761484

    • SHA512

      04831d55dc7affab74f8b3bb8198aca3ad53fd39171f322394c8f414b2c6180c8d89efa4e053803471ebd5ba690d5ee966ad48d7c8e1d79b8f32050064c4fa48

    • SSDEEP

      768:8P1k3hbdlylKsgqopeJBWhZFGkE+cL2NdAJYstYa6PiRDkp3ZiAk4cD3tT:o1k3hbdlylKsgqopeJBWhZFGkE+cL2Nc

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks