General

  • Target

    fdaf02b921c18eac21449e9d754398ddeef9a72f29e93f8cd56d3e2a98dded7e

  • Size

    28KB

  • Sample

    241205-1dyp6azjcq

  • MD5

    67c4fd7cd06ba2d553c6a91cefc7896d

  • SHA1

    dc8cc2e507fabd95daede72c9434f0ab8ec5df1d

  • SHA256

    fdaf02b921c18eac21449e9d754398ddeef9a72f29e93f8cd56d3e2a98dded7e

  • SHA512

    8e919a318c0bd89e3391264d9e761d185dae002eb1e6fe72740fad4be7c575ba45bc03ae5394091e2cec448dd2c039f9181c1758e3131fa70cf2ddc4a9816abe

  • SSDEEP

    192:FPmlLZEvA+6/6r8px8SmvowzxfNIWTRse5A1eptPK4J1IzBNQJDLpmNa:Fi8iS8px8SMDfDRQ8tissNQtLM

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://192.168.8.128:80/6Xlb

Attributes
  • headers User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)

Targets

    • Target

      fdaf02b921c18eac21449e9d754398ddeef9a72f29e93f8cd56d3e2a98dded7e

    • Size

      28KB

    • MD5

      67c4fd7cd06ba2d553c6a91cefc7896d

    • SHA1

      dc8cc2e507fabd95daede72c9434f0ab8ec5df1d

    • SHA256

      fdaf02b921c18eac21449e9d754398ddeef9a72f29e93f8cd56d3e2a98dded7e

    • SHA512

      8e919a318c0bd89e3391264d9e761d185dae002eb1e6fe72740fad4be7c575ba45bc03ae5394091e2cec448dd2c039f9181c1758e3131fa70cf2ddc4a9816abe

    • SSDEEP

      192:FPmlLZEvA+6/6r8px8SmvowzxfNIWTRse5A1eptPK4J1IzBNQJDLpmNa:Fi8iS8px8SMDfDRQ8tissNQtLM

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks