Extracted

Extracted

• • Target

    4434e5b7bbd577a0119ddbacb11744a63299646f4b61efebd83e3ef8fb75f49f

  • Size

    48KB

  • MD5

    33ef79ab8673ac5c7c054b354592b4be

  • SHA1

    cd5c58905c31753f2bc2920053b85de4835fae86

  • SHA256

    4434e5b7bbd577a0119ddbacb11744a63299646f4b61efebd83e3ef8fb75f49f

  • SHA512

    3e8e9572fdaa43df2a7a1ac35985e3a391c4c792db8ff87ccc1c97a14cd17c5cecb04f310f78549d7071008a9b8e73cb848ada677b232a59d4017c63e95ab9bd

  • SSDEEP

    768:LRvwmGuySd63lKBrXlLNO0al7RC4nFF+p0jC+:LVtYSnr1BfiRCEF+pJ+

  Score

  10^/10

  metasploitbackdoordiscoveryexecutiontrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2