General

  • Target

    e36c57431bb8dc766445a40b48761416_JaffaCakes118

  • Size

    14KB

  • Sample

    241211-1zrtqsvkbr

  • MD5

    e36c57431bb8dc766445a40b48761416

  • SHA1

    c3ad1d703375dfafaf1aabcede58f3ff1ca407b8

  • SHA256

    5dbc087925de97e20c6a53a09fe285377d0e2c42c573066c7427715115a1a9ea

  • SHA512

    fa2ed3d8084f8c6e4f30860cc7177bfef3c67712a4d704d2ca2ca1da981cee0c9a4079088d9a51b283cee76bb28dfae65388433d0938aa1ca5cfd232b3569cef

  • SSDEEP

    96:WmHGzq6tjW33XlfYRlIKN45CRouSsvWNxMAYe2chsJNcy:sFtEf2y5CR5AYEsJNc

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

180.176.53.69:443

Targets

    • Target

      e36c57431bb8dc766445a40b48761416_JaffaCakes118

    • Size

      14KB

    • MD5

      e36c57431bb8dc766445a40b48761416

    • SHA1

      c3ad1d703375dfafaf1aabcede58f3ff1ca407b8

    • SHA256

      5dbc087925de97e20c6a53a09fe285377d0e2c42c573066c7427715115a1a9ea

    • SHA512

      fa2ed3d8084f8c6e4f30860cc7177bfef3c67712a4d704d2ca2ca1da981cee0c9a4079088d9a51b283cee76bb28dfae65388433d0938aa1ca5cfd232b3569cef

    • SSDEEP

      96:WmHGzq6tjW33XlfYRlIKN45CRouSsvWNxMAYe2chsJNcy:sFtEf2y5CR5AYEsJNc

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks