General

  • Target

    TrojanDropper.Win32.Boxter.PAA.MTB-31e1703f07bd76589a558b15c260de6589615ad0bddd77c4e7efe9575da80af4N

  • Size

    97KB

  • Sample

    240917-qvd2zawbpk

  • MD5

    df19aad3e807c22af6adfec6ea8ecdc0

  • SHA1

    8624f7f4c130f23bd740d4028aa3e788f5dcc363

  • SHA256

    31e1703f07bd76589a558b15c260de6589615ad0bddd77c4e7efe9575da80af4

  • SHA512

    4f052f678669ea228f782cb7fa20f79e222bda1b9382c7864ef55c7c9d2c20af8fa9ff7681ae1d5523c345373209c754bb34388b856cb6b51dcd981119b9be1d

  • SSDEEP

    1536:k67ftfkS5g9YOms+gZcQipICdXkNDqLLZX9lItVGL++eIOlnToIf8wbYwDUV/2O0:k4FfHgTWmCRkGbKGLeNTBf8OYoEq

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_http

C2

http://192.168.88.128:8080/niYqSBiVlxtyenN7FKXiWQAJ8zoCU

Targets

    • Target

      TrojanDropper.Win32.Boxter.PAA.MTB-31e1703f07bd76589a558b15c260de6589615ad0bddd77c4e7efe9575da80af4N

    • Size

      97KB

    • MD5

      df19aad3e807c22af6adfec6ea8ecdc0

    • SHA1

      8624f7f4c130f23bd740d4028aa3e788f5dcc363

    • SHA256

      31e1703f07bd76589a558b15c260de6589615ad0bddd77c4e7efe9575da80af4

    • SHA512

      4f052f678669ea228f782cb7fa20f79e222bda1b9382c7864ef55c7c9d2c20af8fa9ff7681ae1d5523c345373209c754bb34388b856cb6b51dcd981119b9be1d

    • SSDEEP

      1536:k67ftfkS5g9YOms+gZcQipICdXkNDqLLZX9lItVGL++eIOlnToIf8wbYwDUV/2O0:k4FfHgTWmCRkGbKGLeNTBf8OYoEq

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

MITRE ATT&CK Enterprise v15

Tasks