metasploit | ea67e325327cf7222c1334f89a39c9d47561107750c35c8a461d25628ac3776b | Triage

Sharing

General

Target

d27fb6dac19567bb4819d91d619a3093_JaffaCakes118
Size

81KB
Sample

241207-pwz56asnby
MD5

d27fb6dac19567bb4819d91d619a3093
SHA1

165bf252c76c7cf0ad40a81ba1dc1c73fffc70ce
SHA256

ea67e325327cf7222c1334f89a39c9d47561107750c35c8a461d25628ac3776b
SHA512

6bd8e1da33ddeac41c6f2a51f410b701d99f50d64353331459bd5827bebd90651e5e5d6ff22e3802228d38e4039eec179b91b0bae6f9e1211961dafd54f35f0b
SSDEEP

1536:w1rF28bkKUItsLuworgRHn64wauMGmSApmKk80ZFfx:+5RwJVwauMGmsXZxx

Score

10^/10

metasploit backdoor discovery evasion persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

- Target
  
  d27fb6dac19567bb4819d91d619a3093_JaffaCakes118
- Size
  
  81KB
- MD5
  
  d27fb6dac19567bb4819d91d619a3093
- SHA1
  
  165bf252c76c7cf0ad40a81ba1dc1c73fffc70ce
- SHA256
  
  ea67e325327cf7222c1334f89a39c9d47561107750c35c8a461d25628ac3776b
- SHA512
  
  6bd8e1da33ddeac41c6f2a51f410b701d99f50d64353331459bd5827bebd90651e5e5d6ff22e3802228d38e4039eec179b91b0bae6f9e1211961dafd54f35f0b
- SSDEEP
  
  1536:w1rF28bkKUItsLuworgRHn64wauMGmSApmKk80ZFfx:+5RwJVwauMGmsXZxx
Score

10^/10

metasploit backdoor discovery persistence trojan evasion
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Metasploit family
  metasploit
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

metasploitbackdoordiscoverypersistencetrojan

behavioral2

metasploitbackdoordiscoveryevasionpersistencetrojan