Overview

overview

10

Static

static

3

fdb315d13b...8d.exe

windows7-x64

10

fdb315d13b...8d.exe

windows10-2004-x64

10

$PLUGINSDI...ib.dll

windows7-x64

3

$PLUGINSDI...ib.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

4

$PLUGINSDI...er.dll

windows10-2004-x64

4

bin/DuiLib.dll

windows7-x64

3

bin/DuiLib.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fdb315d13bc1d34e48ee12544f71f913ac0e19a32ee01da633de03e0a5fb708d.exe

  • Size

    22.2MB

  • Sample

    240919-xea4psvcnk

  • MD5

    2a60eeaa91405bf8250b7856273cf7ac

  • SHA1

    fc94dd36d30f943c901d0d137410d6df3748581e

  • SHA256

    fdb315d13bc1d34e48ee12544f71f913ac0e19a32ee01da633de03e0a5fb708d

  • SHA512

    7f4a864b1e60693dd08e36796bc65ccb82db79999c372b76df0b33fed872d2515c2713712b000a81fb8c9433cfb69415756bb8e0083e06512ae7da684ea09e0f

  • SSDEEP

    393216:NgkIH2dXqS8BntKQUJLfKag14WqA9zQk0q6+1AGJKUPofKD6nbP9:N7IH2daS8BnnU5CbjdzSXGJdgf7b1

Score
10/10
metasploitbackdoordiscoverytrojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

149.28.128.13:10000

Targets

    • Target

      fdb315d13bc1d34e48ee12544f71f913ac0e19a32ee01da633de03e0a5fb708d.exe

    • Size

      22.2MB

    • MD5

      2a60eeaa91405bf8250b7856273cf7ac

    • SHA1

      fc94dd36d30f943c901d0d137410d6df3748581e

    • SHA256

      fdb315d13bc1d34e48ee12544f71f913ac0e19a32ee01da633de03e0a5fb708d

    • SHA512

      7f4a864b1e60693dd08e36796bc65ccb82db79999c372b76df0b33fed872d2515c2713712b000a81fb8c9433cfb69415756bb8e0083e06512ae7da684ea09e0f

    • SSDEEP

      393216:NgkIH2dXqS8BntKQUJLfKag14WqA9zQk0q6+1AGJKUPofKD6nbP9:N7IH2daS8BnnU5CbjdzSXGJdgf7b1

    Score
    10/10
    metasploitbackdoordiscoverytrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/DuiLib.dll

    • Size

      1018KB

    • MD5

      e6626fa0a2d68a27054f270b5d428d79

    • SHA1

      946f4e5da38f2fa5b4146149b76c8e2a76e1dfa0

    • SHA256

      971eb84df5e59da6999a76406d70aa160d30cf2bcb2cd804e6692961542983ee

    • SHA512

      31411ce2b9907d5ad3c58e4bcaa14ee19ea4a3c964318aed9e5e5eb0c488d49ab7c2dba3dc31e58b5100bb730d37b79bd0db0fe5eb26e7c7d26f76c8e1925166

    • SSDEEP

      12288:esCGCO+18Cj6SHQNYhsoGRf/1cWWl5Jc/C+SH7gnv7imjD/jt7a1nW7+Im6xb1E:e0Je86efdhic/C+SIjo9ka

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/installer-helper.dll

    • Size

      580KB

    • MD5

      fb921ddcb1cbff938b18d1f2a24207d7

    • SHA1

      214216d7bddb50409aad3c9daf59c4f1f7b2f03b

    • SHA256

      deed4220c0e464112b3c2078dddeb26b3233e16fa4db9b61f14da08755618ba8

    • SHA512

      d85fb13f763b80ff6570758c20bd3d92f0a1e1b39f1254adafe3d3149d1fcb6e3082f1ca103f3bbd243bd094ca818a1783aec24aee0e6f9146a3d2d731ae2a80

    • SSDEEP

      12288:WUEFu2meia9r5FjuD09ySN03nse6UbevY0MBh9C95PGfr208:qR9zuD026UbeQ0UrC95Ofi08

    Score
    4/10
    discovery
    behavioral5behavioral6

    • Target

      bin/DuiLib.dll

    • Size

      1018KB

    • MD5

      e6626fa0a2d68a27054f270b5d428d79

    • SHA1

      946f4e5da38f2fa5b4146149b76c8e2a76e1dfa0

    • SHA256

      971eb84df5e59da6999a76406d70aa160d30cf2bcb2cd804e6692961542983ee

    • SHA512

      31411ce2b9907d5ad3c58e4bcaa14ee19ea4a3c964318aed9e5e5eb0c488d49ab7c2dba3dc31e58b5100bb730d37b79bd0db0fe5eb26e7c7d26f76c8e1925166

    • SSDEEP

      12288:esCGCO+18Cj6SHQNYhsoGRf/1cWWl5Jc/C+SH7gnv7imjD/jt7a1nW7+Im6xb1E:e0Je86efdhic/C+SIjo9ka

    Score
    3/10
    discovery
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks