General

  • Target

    6399ec7931f939a771f05b26c5f87c249967b60a1149fdf19d83afcd6dbb052c

  • Size

    16KB

  • Sample

    241220-1cvxwatrh1

  • MD5

    24a35175bdb1cac4ee36416d1b764f47

  • SHA1

    b576b6f25a58fb6c4d8b30deb1ed505ef6b38756

  • SHA256

    6399ec7931f939a771f05b26c5f87c249967b60a1149fdf19d83afcd6dbb052c

  • SHA512

    ed975a5da64f322d2d1853595bc5d85fef90fafe501085ae820373d87333db8c10607bdddfd6bba0020f59280db9bb618125bfe6972fa7ed43aa0bdea88ba6fa

  • SSDEEP

    384:034xEqle7ZIWq34kSnPFquOnFCaU/lsOvvZazPU:034/8N9P8znYaenn

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_http

C2

http://10.0.2.15:443/KRJrPvvKgWEpUihTTjbEEA7nPzU51HXOpUO-GK4eD8483muBlQcAAmJDuT8MLv3A4yJuKbmf3nfrzSyzLN

Targets

    • Target

      6399ec7931f939a771f05b26c5f87c249967b60a1149fdf19d83afcd6dbb052c

    • Size

      16KB

    • MD5

      24a35175bdb1cac4ee36416d1b764f47

    • SHA1

      b576b6f25a58fb6c4d8b30deb1ed505ef6b38756

    • SHA256

      6399ec7931f939a771f05b26c5f87c249967b60a1149fdf19d83afcd6dbb052c

    • SHA512

      ed975a5da64f322d2d1853595bc5d85fef90fafe501085ae820373d87333db8c10607bdddfd6bba0020f59280db9bb618125bfe6972fa7ed43aa0bdea88ba6fa

    • SSDEEP

      384:034xEqle7ZIWq34kSnPFquOnFCaU/lsOvvZazPU:034/8N9P8znYaenn

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

MITRE ATT&CK Enterprise v15

Tasks