General

  • Target

    c6b203f66a77dd285afae967774b0ae6cccbafac1b436b3e977f30b757be3280

  • Size

    42KB

  • Sample

    241205-1g2wzssrdz

  • MD5

    4cc91b9a5dfe93c3b37af0a5cdbd6b83

  • SHA1

    a9efe1ad1127ba50814d6413efeab6770bc22df3

  • SHA256

    c6b203f66a77dd285afae967774b0ae6cccbafac1b436b3e977f30b757be3280

  • SHA512

    667db0a850bd7a934163babc76ea849de9ea3203f27fc44773184afc1a8590b0b41d707c569c97d700746ddd80febc5feba4a03cb68ee147e096c92319f7c6d2

  • SSDEEP

    384:fi8iS8px8SMDfDRCttBXZtFyTz+pek/iuE/H7kyzQ/+DQCgN0jFp/:fq3ySZtFi+pekqRP5W+K6p/

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://192.168.8.128:80/6Xlb

Attributes
  • headers User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)

Targets

    • Target

      c6b203f66a77dd285afae967774b0ae6cccbafac1b436b3e977f30b757be3280

    • Size

      42KB

    • MD5

      4cc91b9a5dfe93c3b37af0a5cdbd6b83

    • SHA1

      a9efe1ad1127ba50814d6413efeab6770bc22df3

    • SHA256

      c6b203f66a77dd285afae967774b0ae6cccbafac1b436b3e977f30b757be3280

    • SHA512

      667db0a850bd7a934163babc76ea849de9ea3203f27fc44773184afc1a8590b0b41d707c569c97d700746ddd80febc5feba4a03cb68ee147e096c92319f7c6d2

    • SSDEEP

      384:fi8iS8px8SMDfDRCttBXZtFyTz+pek/iuE/H7kyzQ/+DQCgN0jFp/:fq3ySZtFi+pekqRP5W+K6p/

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks