General

  • Target

    ccb39945aa9cb28f9bbc6895525ee21791c83acb7bb0075dc845d8c84bb09108

  • Size

    14KB

  • Sample

    241119-rhheasxfmk

  • MD5

    9136f4f48e6075a604849be03d7c6d11

  • SHA1

    a91bf5280e7ec8ea3446b03ad74d6c75924828b2

  • SHA256

    ccb39945aa9cb28f9bbc6895525ee21791c83acb7bb0075dc845d8c84bb09108

  • SHA512

    1e37aebfa272c3932cc5b8d677b676bd553a0f3168fc4d86b4864ed05d417f8db6b08dbeee17f11e3287117f07a8e754a477bda38d6a7871da48bb1fc4d30252

  • SSDEEP

    192:O3mbPYCfMcrfOIuZmvKQxtzlSIVX6NOlKEYjVXejDMN1:NMCfrfQ6tBSIXgpeUN1

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://8.138.5.136:2233/ReSR

Attributes
  • headers User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MANM; MANM)

Targets

    • Target

      ccb39945aa9cb28f9bbc6895525ee21791c83acb7bb0075dc845d8c84bb09108

    • Size

      14KB

    • MD5

      9136f4f48e6075a604849be03d7c6d11

    • SHA1

      a91bf5280e7ec8ea3446b03ad74d6c75924828b2

    • SHA256

      ccb39945aa9cb28f9bbc6895525ee21791c83acb7bb0075dc845d8c84bb09108

    • SHA512

      1e37aebfa272c3932cc5b8d677b676bd553a0f3168fc4d86b4864ed05d417f8db6b08dbeee17f11e3287117f07a8e754a477bda38d6a7871da48bb1fc4d30252

    • SSDEEP

      192:O3mbPYCfMcrfOIuZmvKQxtzlSIVX6NOlKEYjVXejDMN1:NMCfrfQ6tBSIXgpeUN1

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

MITRE ATT&CK Enterprise v15

Tasks