metasploit | 1bc7b8ec5b560893981f8264e819c75f4731a0734ec3e49cc54a906a3143584d | Triage

Sharing

General

Target

e8510e60bb69906663266ed956c44a0f_JaffaCakes118
Size

15KB
Sample

240918-ewlmnasgnm
MD5

e8510e60bb69906663266ed956c44a0f
SHA1

a1e60443308e8b7768d13b12828dffbe1f7c9775
SHA256

1bc7b8ec5b560893981f8264e819c75f4731a0734ec3e49cc54a906a3143584d
SHA512

714765aad30a83cf1e9f26b541f20b8aeea237f837a5ef6db229add1c844bafd12b4187d726950326cf297cfe3e81cc139560c70367294349a191973b4dde008
SSDEEP

192:ZYf2ZQu9g0tYuokm+SRJkDlBpaViNnrP4iC9Yg8IDl4bXjHOk8Y9:ZYfKQu9g0S/km+SRJA/NvssXjHeY

Score

10^/10

metasploit backdoor discovery execution trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://204.44.83.217:443/pnL2

Targets

- Target
  
  e8510e60bb69906663266ed956c44a0f_JaffaCakes118
- Size
  
  15KB
- MD5
  
  e8510e60bb69906663266ed956c44a0f
- SHA1
  
  a1e60443308e8b7768d13b12828dffbe1f7c9775
- SHA256
  
  1bc7b8ec5b560893981f8264e819c75f4731a0734ec3e49cc54a906a3143584d
- SHA512
  
  714765aad30a83cf1e9f26b541f20b8aeea237f837a5ef6db229add1c844bafd12b4187d726950326cf297cfe3e81cc139560c70367294349a191973b4dde008
- SSDEEP
  
  192:ZYf2ZQu9g0tYuokm+SRJkDlBpaViNnrP4iC9Yg8IDl4bXjHOk8Y9:ZYfKQu9g0S/km+SRJA/NvssXjHeY
Score

10^/10

metasploit backdoor discovery execution trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Blocklisted process makes network request
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

metasploitbackdoordiscoveryexecutiontrojan