General

  • Target

    10ea7258010c5caac202b2f6ecc6b203f7069b6ebba673b232366cbd9fbac890.exe

  • Size

    572KB

  • Sample

    241204-cm81gs1rek

  • MD5

    2d1dfd798d2972fb9b3fda501bc34a92

  • SHA1

    eb747f9de3dcfef839fe96e46ce895c4304b665f

  • SHA256

    10ea7258010c5caac202b2f6ecc6b203f7069b6ebba673b232366cbd9fbac890

  • SHA512

    728f688296895d4f9b40dbdbeba5c54542f224b2d683c4fde2a889abe8c2b1e614b3aa388db8009ae5deaa744de02145aa86ea4d1a437f0ab22cb21442bfd68f

  • SSDEEP

    12288:Zj/CQozdkGbVuhWN1pDtshGJlHugrtE6E3JMIz1umoxkK:0BzddbIhWUqHuL3SwuL

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

180.109.156.243:5656

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Targets

    • Target

      10ea7258010c5caac202b2f6ecc6b203f7069b6ebba673b232366cbd9fbac890.exe

    • Size

      572KB

    • MD5

      2d1dfd798d2972fb9b3fda501bc34a92

    • SHA1

      eb747f9de3dcfef839fe96e46ce895c4304b665f

    • SHA256

      10ea7258010c5caac202b2f6ecc6b203f7069b6ebba673b232366cbd9fbac890

    • SHA512

      728f688296895d4f9b40dbdbeba5c54542f224b2d683c4fde2a889abe8c2b1e614b3aa388db8009ae5deaa744de02145aa86ea4d1a437f0ab22cb21442bfd68f

    • SSDEEP

      12288:Zj/CQozdkGbVuhWN1pDtshGJlHugrtE6E3JMIz1umoxkK:0BzddbIhWUqHuL3SwuL

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

MITRE ATT&CK Enterprise v15

Tasks