General

  • Target

    ccf57b26f850e951f8963de1859b347da7c45a2cc3b2873363285002a205677c

  • Size

    35KB

  • Sample

    241206-1dfvcavlgj

  • MD5

    988330297a4f3a8f5e805352395e343f

  • SHA1

    af83c9ecc0848e3591d4f4a4ecea270e818ca65e

  • SHA256

    ccf57b26f850e951f8963de1859b347da7c45a2cc3b2873363285002a205677c

  • SHA512

    b952d12bb4771ff7a6c2e396275d11159a03e3eeb36a211951cfb8d933a4cb2c6129b80246a384d04e529431cf2c615b5ad3188de638864d7a810758d2beca18

  • SSDEEP

    384:pSiSwvxjk+tbG3KyVJxfg0jkjH+pz/bT0f8XuJiFtq:pVxw+tgJxohjH+pHTl+4

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

127.0.0.1:4444

Targets

    • Target

      ccf57b26f850e951f8963de1859b347da7c45a2cc3b2873363285002a205677c

    • Size

      35KB

    • MD5

      988330297a4f3a8f5e805352395e343f

    • SHA1

      af83c9ecc0848e3591d4f4a4ecea270e818ca65e

    • SHA256

      ccf57b26f850e951f8963de1859b347da7c45a2cc3b2873363285002a205677c

    • SHA512

      b952d12bb4771ff7a6c2e396275d11159a03e3eeb36a211951cfb8d933a4cb2c6129b80246a384d04e529431cf2c615b5ad3188de638864d7a810758d2beca18

    • SSDEEP

      384:pSiSwvxjk+tbG3KyVJxfg0jkjH+pz/bT0f8XuJiFtq:pVxw+tgJxohjH+pHTl+4

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

MITRE ATT&CK Enterprise v15

Tasks