General

  • Target

    229d6b9e1c75bed7e619c1e3bcdc01f8f8cabf367e963940f9d6f3f69f7b9d93.exe

  • Size

    1.0MB

  • Sample

    241205-w9rjhawpgw

  • MD5

    7cd03f44e9a96304226ed8882aae0347

  • SHA1

    203de0d1647a7319b35792943b4ba6e25f3fe90f

  • SHA256

    229d6b9e1c75bed7e619c1e3bcdc01f8f8cabf367e963940f9d6f3f69f7b9d93

  • SHA512

    b7921cabcd2844072aea451d29e5f3acad1d42d0f68ab0c2e40f7fb2a1a05d66e1d6509c5da53d03ac991304cd1a87ad742ea2365ecdbade3cbaabb71a65628b

  • SSDEEP

    12288:7OFipA01X+PpdsnBVA5hEmgJ/AkJtc2Y4Ucdo4UGACh3QTiMqqQCUO:mia01X+PpdsnBeFgdJtc2Y4UcY4gjPx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      229d6b9e1c75bed7e619c1e3bcdc01f8f8cabf367e963940f9d6f3f69f7b9d93.exe

    • Size

      1.0MB

    • MD5

      7cd03f44e9a96304226ed8882aae0347

    • SHA1

      203de0d1647a7319b35792943b4ba6e25f3fe90f

    • SHA256

      229d6b9e1c75bed7e619c1e3bcdc01f8f8cabf367e963940f9d6f3f69f7b9d93

    • SHA512

      b7921cabcd2844072aea451d29e5f3acad1d42d0f68ab0c2e40f7fb2a1a05d66e1d6509c5da53d03ac991304cd1a87ad742ea2365ecdbade3cbaabb71a65628b

    • SSDEEP

      12288:7OFipA01X+PpdsnBVA5hEmgJ/AkJtc2Y4Ucdo4UGACh3QTiMqqQCUO:mia01X+PpdsnBeFgdJtc2Y4UcY4gjPx

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks