General

  • Target

    c41d27d8a506bd34b275f53b52f7b8e8_JaffaCakes118

  • Size

    37KB

  • Sample

    241204-yh9bcatmej

  • MD5

    c41d27d8a506bd34b275f53b52f7b8e8

  • SHA1

    63525f5e85fbb1ece535a5f37b626d979441e8c0

  • SHA256

    bac583a04314aefc74e41c250c560b6880b0a4ef7d2f3facd11b457e27a70344

  • SHA512

    15571a778a365d28d0de7a77a2eeff7187847d72e450d56b05677d6397d3018b5dc2b3f03a3719487f97e7a46d1648825920899b69d0535d3803f3baeaa9f066

  • SSDEEP

    768:aVATS/Emj2scCUIV0vO77zhtLnNPMZKQ36lRZ95x:cVjsIn1lNPMsnh5x

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

192.168.2.43:4444

Targets

    • Target

      c41d27d8a506bd34b275f53b52f7b8e8_JaffaCakes118

    • Size

      37KB

    • MD5

      c41d27d8a506bd34b275f53b52f7b8e8

    • SHA1

      63525f5e85fbb1ece535a5f37b626d979441e8c0

    • SHA256

      bac583a04314aefc74e41c250c560b6880b0a4ef7d2f3facd11b457e27a70344

    • SHA512

      15571a778a365d28d0de7a77a2eeff7187847d72e450d56b05677d6397d3018b5dc2b3f03a3719487f97e7a46d1648825920899b69d0535d3803f3baeaa9f066

    • SSDEEP

      768:aVATS/Emj2scCUIV0vO77zhtLnNPMZKQ36lRZ95x:cVjsIn1lNPMsnh5x

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

MITRE ATT&CK Enterprise v15

Tasks