metasploit | e10d79e6281250fc1ef43c106a5c0a06ae6a61ce496b60f8d30d61a18fd91e26 | Triage

Sharing

General

Target

ed1d69d06257f3c5e5cefe4815b7600c_JaffaCakes118
Size

1.6MB
Sample

240920-jel93swanl
MD5

ed1d69d06257f3c5e5cefe4815b7600c
SHA1

e56247fd66e243c7c52fd53439dc2f77efb2c7cd
SHA256

e10d79e6281250fc1ef43c106a5c0a06ae6a61ce496b60f8d30d61a18fd91e26
SHA512

3cd4499f8ea2b8d1e80913964da25d094f7a1e1420bbab48a211daf75218ad3836eba1f4cd3de1d8765d8a8c21f6a835780a2771bd2e74fedd1335c9535f6be3
SSDEEP

24576:zPf3haLo6eAVSm89e/uD2TNXn2zcgJ80yEi+4k2Dnabnpn1vzOe2V5jEXMMgMM9t:zPf3hmhlKJhi+VVbp1vzOe2QMMgMM9Z

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

192.168.56.102:443

Targets

- Target
  
  ed1d69d06257f3c5e5cefe4815b7600c_JaffaCakes118
- Size
  
  1.6MB
- MD5
  
  ed1d69d06257f3c5e5cefe4815b7600c
- SHA1
  
  e56247fd66e243c7c52fd53439dc2f77efb2c7cd
- SHA256
  
  e10d79e6281250fc1ef43c106a5c0a06ae6a61ce496b60f8d30d61a18fd91e26
- SHA512
  
  3cd4499f8ea2b8d1e80913964da25d094f7a1e1420bbab48a211daf75218ad3836eba1f4cd3de1d8765d8a8c21f6a835780a2771bd2e74fedd1335c9535f6be3
- SSDEEP
  
  24576:zPf3haLo6eAVSm89e/uD2TNXn2zcgJ80yEi+4k2Dnabnpn1vzOe2V5jEXMMgMM9t:zPf3hmhlKJhi+VVbp1vzOe2QMMgMM9Z
Score

10^/10

metasploit backdoor discovery trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

metasploitbackdoordiscoverytrojan

behavioral2

metasploitbackdoordiscoverytrojan