General

  • Target

    6a69158fd60658de3fef73faed168c37943382faa9208025c0f4e13115dc0951

  • Size

    49KB

  • Sample

    241116-1k2qdsvbnp

  • MD5

    18d4a1198b787ded87086c77dbb0b81c

  • SHA1

    94c553717ce3cd22fa319490e84689ebd17024c4

  • SHA256

    6a69158fd60658de3fef73faed168c37943382faa9208025c0f4e13115dc0951

  • SHA512

    bbe7266bc94a0b2bd95ef962dfdf36503da378e580ca91c363a68125b802ef5013202f70797ca445b96d5c1887e9b35493272be026a10631e78a29da2052b4cc

  • SSDEEP

    384:Tcx6TNFHiSoqONljlX2EZtRsdF+pC/KBh50jQ:YizCH23+pZ

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

192.168.230.135:4444

Targets

    • Target

      6a69158fd60658de3fef73faed168c37943382faa9208025c0f4e13115dc0951

    • Size

      49KB

    • MD5

      18d4a1198b787ded87086c77dbb0b81c

    • SHA1

      94c553717ce3cd22fa319490e84689ebd17024c4

    • SHA256

      6a69158fd60658de3fef73faed168c37943382faa9208025c0f4e13115dc0951

    • SHA512

      bbe7266bc94a0b2bd95ef962dfdf36503da378e580ca91c363a68125b802ef5013202f70797ca445b96d5c1887e9b35493272be026a10631e78a29da2052b4cc

    • SSDEEP

      384:Tcx6TNFHiSoqONljlX2EZtRsdF+pC/KBh50jQ:YizCH23+pZ

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

MITRE ATT&CK Enterprise v15

Tasks