General

  • Target

    b4e016711dd41b45bb52a3a45d7029fd106da804436a2f4ad1bc854fbd16fa70N

  • Size

    17KB

  • Sample

    240916-yrllmsxbrh

  • MD5

    d611d8f472f1f149e1cb216789afebd0

  • SHA1

    9a7e8e4e068e367cfd6e6da54b75bb5ae6232220

  • SHA256

    b4e016711dd41b45bb52a3a45d7029fd106da804436a2f4ad1bc854fbd16fa70

  • SHA512

    3b9829e708b88f6d022e2201cf04528b648e13ec6fc5a9bcb80e901a6fff4d83462146d0e2168281534f0c4230251f987848680985dc1cdb26b6f52c3fb05857

  • SSDEEP

    384:yEEoLO56ayzcMj+2FbEiwtMwicYyINejH517p8h:FE8O56lcVwwicjINen7S

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

192.168.1.10:4444

Targets

    • Target

      b4e016711dd41b45bb52a3a45d7029fd106da804436a2f4ad1bc854fbd16fa70N

    • Size

      17KB

    • MD5

      d611d8f472f1f149e1cb216789afebd0

    • SHA1

      9a7e8e4e068e367cfd6e6da54b75bb5ae6232220

    • SHA256

      b4e016711dd41b45bb52a3a45d7029fd106da804436a2f4ad1bc854fbd16fa70

    • SHA512

      3b9829e708b88f6d022e2201cf04528b648e13ec6fc5a9bcb80e901a6fff4d83462146d0e2168281534f0c4230251f987848680985dc1cdb26b6f52c3fb05857

    • SSDEEP

      384:yEEoLO56ayzcMj+2FbEiwtMwicYyINejH517p8h:FE8O56lcVwwicjINen7S

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

MITRE ATT&CK Enterprise v15

Tasks