General

  • Target

    c492e0485101e60cbd131228352df87f_JaffaCakes118

  • Size

    1.2MB

  • Sample

    241204-1yv5rstlew

  • MD5

    c492e0485101e60cbd131228352df87f

  • SHA1

    27cdea226f1fc79574113a069f4068581047036c

  • SHA256

    4e662289ac43de1ab9f062e15ba67a0c310f78be6813caaba16d357eaff979df

  • SHA512

    291ad08aa46de62b36acf247a350c2b152e764d96afa77e8ba68cf3978c895d12e0f13053109096dc015ffb0c2c6e886031ad2073744503bd1a07b784ee5ebe7

  • SSDEEP

    24576:M9ou0ddo7TpRHnGvcfqzG9mi/W0QwwQYRHW/nStWPKIPDk:MEjo7F9n6s+nwlYR2/SIfDk

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

192.168.10.2:1234

Targets

    • Target

      c492e0485101e60cbd131228352df87f_JaffaCakes118

    • Size

      1.2MB

    • MD5

      c492e0485101e60cbd131228352df87f

    • SHA1

      27cdea226f1fc79574113a069f4068581047036c

    • SHA256

      4e662289ac43de1ab9f062e15ba67a0c310f78be6813caaba16d357eaff979df

    • SHA512

      291ad08aa46de62b36acf247a350c2b152e764d96afa77e8ba68cf3978c895d12e0f13053109096dc015ffb0c2c6e886031ad2073744503bd1a07b784ee5ebe7

    • SSDEEP

      24576:M9ou0ddo7TpRHnGvcfqzG9mi/W0QwwQYRHW/nStWPKIPDk:MEjo7F9n6s+nwlYR2/SIfDk

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks