General

  • Target

    Trojan.Win32.Swrort.A-e29bd0f5260aeff2aa6c981358820702d3dd84194bc8df1696864973c2770ec1N

  • Size

    648KB

  • Sample

    240917-w658gsxhrf

  • MD5

    cdd15e789fb08ba75454354c1591ac10

  • SHA1

    0a51bfde3d79972472cdbb2a4205074544ef7203

  • SHA256

    e29bd0f5260aeff2aa6c981358820702d3dd84194bc8df1696864973c2770ec1

  • SHA512

    a8346f4fb14b31e75bfeb2d6728864bc34cb1273a785b4e5de286b9716da681002b3c15ea85dcfdf1bd59cd2b0d066eb26baf0ce3291feebc169d8d7acf6eef4

  • SSDEEP

    12288:X2Hl/LW8WanB1q7XVMJe8UbBVAR4qfZNuG9qU6Ako9d7rCs4UA8g:X2H5LuanB1alMJlUbY3fCG9YAk0/xB

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://8.219.137.92:80/y6He

Attributes
  • headers User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)

Targets

    • Target

      Trojan.Win32.Swrort.A-e29bd0f5260aeff2aa6c981358820702d3dd84194bc8df1696864973c2770ec1N

    • Size

      648KB

    • MD5

      cdd15e789fb08ba75454354c1591ac10

    • SHA1

      0a51bfde3d79972472cdbb2a4205074544ef7203

    • SHA256

      e29bd0f5260aeff2aa6c981358820702d3dd84194bc8df1696864973c2770ec1

    • SHA512

      a8346f4fb14b31e75bfeb2d6728864bc34cb1273a785b4e5de286b9716da681002b3c15ea85dcfdf1bd59cd2b0d066eb26baf0ce3291feebc169d8d7acf6eef4

    • SSDEEP

      12288:X2Hl/LW8WanB1q7XVMJe8UbBVAR4qfZNuG9qU6Ako9d7rCs4UA8g:X2H5LuanB1alMJlUbY3fCG9YAk0/xB

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

MITRE ATT&CK Enterprise v15

Tasks