metasploit | a9186d7c4de1c62c2f27aa22e0e9c550f6e5a0552acca8dfbdb6bbe4fe396f36 | Triage

Sharing

General

Target

a9186d7c4de1c62c2f27aa22e0e9c550f6e5a0552acca8dfbdb6bbe4fe396f36
Size

61KB
Sample

241221-ecwcrasmbk
MD5

ff148364120acb09dfbba6d3b0bc351e
SHA1

5531aa7d26fadc5be96c06f5339793db5429fd16
SHA256

a9186d7c4de1c62c2f27aa22e0e9c550f6e5a0552acca8dfbdb6bbe4fe396f36
SHA512

37ccf5822007255fcbe2fb264745cce40003d8c053b1d8dde29a86a31b2816f3cf457212fe75eecafd7905adc7df3686ed48d4dad1d2a7bc7634e567ffc6dcb5
SSDEEP

1536:HAjfrlVBlSmPd7u8CcQ8agm2Y6YF8Jf7K:HAjzfnSmPdCLTVF897K

Score

10^/10

metasploit backdoor discovery persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

- Target
  
  a9186d7c4de1c62c2f27aa22e0e9c550f6e5a0552acca8dfbdb6bbe4fe396f36
- Size
  
  61KB
- MD5
  
  ff148364120acb09dfbba6d3b0bc351e
- SHA1
  
  5531aa7d26fadc5be96c06f5339793db5429fd16
- SHA256
  
  a9186d7c4de1c62c2f27aa22e0e9c550f6e5a0552acca8dfbdb6bbe4fe396f36
- SHA512
  
  37ccf5822007255fcbe2fb264745cce40003d8c053b1d8dde29a86a31b2816f3cf457212fe75eecafd7905adc7df3686ed48d4dad1d2a7bc7634e567ffc6dcb5
- SSDEEP
  
  1536:HAjfrlVBlSmPd7u8CcQ8agm2Y6YF8Jf7K:HAjzfnSmPdCLTVF897K
Score

10^/10

metasploit backdoor discovery persistence trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Metasploit family
  metasploit
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

metasploitbackdoordiscoverypersistencetrojan

behavioral2

metasploitbackdoordiscoverypersistencetrojan