General

  • Target

    3febb5ec66331640d256ed6021be850f122d9cc1cc27bae921b80b00828ec255.exe

  • Size

    9KB

  • Sample

    241117-3g7tcazraw

  • MD5

    7da82665c5b4b3cabeb91e15b3151194

  • SHA1

    1ca3d24e49fd700f8f7dba15836bc8c42ba48b5b

  • SHA256

    3febb5ec66331640d256ed6021be850f122d9cc1cc27bae921b80b00828ec255

  • SHA512

    6293e2cdc24ddcae7600261bcc01acae28f1b45b926d5fe5385d2ed23203b40378243fd55fe11286944d215c87730bcefff012ab187d9744a1b84b4af25bc9b8

  • SSDEEP

    48:q0kV3zU9G4aNVh7XphlhEF57/ncCYxZrCO1LapHvfbOEe:vDIKkfB0v4

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_http

C2

http://134.195.90.78:8087/5Mum3OyRa87-4__imdajzAxKXjhcQsuMcGQRPA50eK8AZD4OxYErkz-FgvzGH5bDnSInM5JBqmxslDEWpd3AFbuWtXiKY7mHY96PhlJzv9SEcnS-FTBTooFAcR9QD9FgDpDjKiwhU5592pbo8ks-VcKyJNPUIyghWQ

Targets

    • Target

      3febb5ec66331640d256ed6021be850f122d9cc1cc27bae921b80b00828ec255.exe

    • Size

      9KB

    • MD5

      7da82665c5b4b3cabeb91e15b3151194

    • SHA1

      1ca3d24e49fd700f8f7dba15836bc8c42ba48b5b

    • SHA256

      3febb5ec66331640d256ed6021be850f122d9cc1cc27bae921b80b00828ec255

    • SHA512

      6293e2cdc24ddcae7600261bcc01acae28f1b45b926d5fe5385d2ed23203b40378243fd55fe11286944d215c87730bcefff012ab187d9744a1b84b4af25bc9b8

    • SSDEEP

      48:q0kV3zU9G4aNVh7XphlhEF57/ncCYxZrCO1LapHvfbOEe:vDIKkfB0v4

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks