General

  • Target

    f87237859e6849d770c327ae300cdfbff8b8f9193e8ace2f739f8629a087b7f3

  • Size

    14.3MB

  • MD5

    6fcd7ac1028668bcda61633dd40f1f49

  • SHA1

    bd9547ee86e28fc01fe459b91c2c5ee090fbe2cb

  • SHA256

    f87237859e6849d770c327ae300cdfbff8b8f9193e8ace2f739f8629a087b7f3

  • SHA512

    cd4a68943fc2995fac19beaf99949e9b68238a7759d6744e569f3fa0ab7e6ea413c40a3cc2af447366db71dbe48106c79f5a403d797ff03de431d802f4f968c3

  • SSDEEP

    393216:oZo8lNCe0Iymb6JrIpgp+ueSrfAZa5EkwBN5Tc:oq8liJEpa+6iNlc

Score
10/10

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://101.34.205.247:443/jquery-3.3.1.slim.min.js

Signatures

  • Metasploit family
  • Unsigned PE 5 IoCs

    Checks for missing Authenticode signature.

Files

  • f87237859e6849d770c327ae300cdfbff8b8f9193e8ace2f739f8629a087b7f3
    .zip
  • 101.34.205.247:8080/.DS_Store
  • 101.34.205.247:8080/33.txt
  • 101.34.205.247:8080/BsSndRpt1.exe
    .exe windows:6 windows x64 arch:x64

    6b4ebbc76a24a32743d71833b7b047b2


    Code Sign

    Headers

    Imports

    Sections

  • 101.34.205.247:8080/BugSplatRc64.dll
    .dll windows:6 windows x64 arch:x64

    c8cab1972b3ba5955077d319a689516c


    Headers

    Imports

    Exports

    Sections

  • 101.34.205.247:8080/checker.exe
    .exe windows:5 windows x64 arch:x64

    7ee2ff4d75ec27ee2f4e0cc4e2424986


    Headers

    Imports

    Exports

    Sections

  • 101.34.205.247:8080/cs/.DS_Store
  • 101.34.205.247:8080/cs/help.dll
    .dll windows:6 windows x64 arch:x64

    29928cc8b6c099534ed3c048707b8e8f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • 101.34.205.247:8080/cs/logon.exe
    .exe windows:5 windows x64 arch:x64

    7ee2ff4d75ec27ee2f4e0cc4e2424986


    Headers

    Imports

    Exports

    Sections

  • 101.34.205.247:8080/cs/parfait.dll
    .dll windows:6 windows x64 arch:x64

    53ddc0e7df312cddd94f9ac19fc1b83d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • 101.34.205.247:8080/get.exe
    .exe windows:6 windows x64 arch:x64

    9cd12d9f6cec0a2da4ded5a7c6bb3bbb


    Headers

    Imports

    Exports

    Sections

  • 101.34.205.247:8080/help.dll
    .dll windows:6 windows x64 arch:x64

    29928cc8b6c099534ed3c048707b8e8f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • 101.34.205.247:8080/output.exe
    .exe windows:6 windows x86 arch:x86

    76dc543bb336dc462cc5429c1182ea0a


    Code Sign

    Headers

    Imports

    Sections

  • 101.34.205.247:8080/parfait.dll
    .dll windows:6 windows x64 arch:x64

    53ddc0e7df312cddd94f9ac19fc1b83d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • 101.34.205.247:8080/update.dat
  • 101.34.205.247:8080/vshell_x86/.DS_Store
  • 101.34.205.247:8080/vshell_x86/lib.dll
    .dll windows:6 windows x86 arch:x86

    2262054530b5f8bbeb0c4e3a111a37eb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • 101.34.205.247:8080/vshell_x86/uninstall.exe
    .exe windows:6 windows x86 arch:x86

    abe504c523d3fc4f1c0b2f391d68a263


    Headers

    Imports

    Sections

  • 101.34.205.247:8080/vshell_x86/vcruntime140.dll
    .dll windows:6 windows x86 arch:x86

    582baffa61398d91fecd31e121380570


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • 101.34.205.247:8080/x86.exe
    .exe windows:6 windows x86 arch:x86

    76dc543bb336dc462cc5429c1182ea0a


    Code Sign

    Headers

    Imports

    Sections

  • __MACOSX/101.34.205.247:8080/._.DS_Store
  • __MACOSX/101.34.205.247:8080/cs/._.DS_Store
  • __MACOSX/101.34.205.247:8080/vshell_x86/._.DS_Store