metasploit

General

Target

27c80ef034bd4fa9fe831f2079d9b904c91340bb1e0842c75150d63cf3d162bfN.exe
Size

9KB
Sample

241117-3n5mka1mgz
MD5

0e0503501bc82e5e4c185af848e1cdf0
SHA1

596dc9017d8fc5877058cdcc924d917e3d0963c1
SHA256

27c80ef034bd4fa9fe831f2079d9b904c91340bb1e0842c75150d63cf3d162bf
SHA512

46f24ec9b59faed1e5185cfdbde973a5887609fb80572122a4728178564e50083866262311b4ba7dd4d8c789a820bd96413b0282497682d2e6ac5e0afd4b5ef4
SSDEEP

48:q0kV3zU9G4aNVh7XphlhEF57/ncCYxZrCO1LapHvfbOE:vDIKkfB0v

Score

10^/10

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_http

C2

http://134.195.90.78:8087/5Mum3OyRa87-4__imdajzAxKXjhcQsuMcGQRPA50eK8AZD4OxYErkz-FgvzGH5bDnSInM5JBqmxslDEWpd3AFbuWtXiKY7mHY96PhlJzv9SEcnS-FTBTooFAcR9QD9FgDpDjKiwhU5592pbo8ks-VcKyJNPUIyghWQ

Targets

- Target
  
  27c80ef034bd4fa9fe831f2079d9b904c91340bb1e0842c75150d63cf3d162bfN.exe
- Size
  
  9KB
- MD5
  
  0e0503501bc82e5e4c185af848e1cdf0
- SHA1
  
  596dc9017d8fc5877058cdcc924d917e3d0963c1
- SHA256
  
  27c80ef034bd4fa9fe831f2079d9b904c91340bb1e0842c75150d63cf3d162bf
- SHA512
  
  46f24ec9b59faed1e5185cfdbde973a5887609fb80572122a4728178564e50083866262311b4ba7dd4d8c789a820bd96413b0282497682d2e6ac5e0afd4b5ef4
- SSDEEP
  
  48:q0kV3zU9G4aNVh7XphlhEF57/ncCYxZrCO1LapHvfbOE:vDIKkfB0v
Score

10^/10

metasploit backdoor discovery trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Metasploit family
  metasploit
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Metasploit family

Blocklisted process makes network request

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2