General

  • Target

    a6bdfb7e8e9933bb7784ca2a3332838687b6872302fd7c5487374f3aacf68457

  • Size

    2.0MB

  • Sample

    241221-nq66vayqck

  • MD5

    aae6059d749615e36e4f93d5751faadc

  • SHA1

    bc1619075d21a4e153ee1cf1356f7c1e9000c5e3

  • SHA256

    a6bdfb7e8e9933bb7784ca2a3332838687b6872302fd7c5487374f3aacf68457

  • SHA512

    70a2995de5662a90fca59d085017dcc95b886010e34a1dc8f8c04e2f712a268bb09b8374dbb90489e76fda25b570a97de8ba5e0a03ff900d234836d8aa92aba2

  • SSDEEP

    24576:ets+S6JFH0kO0gQpKHOrCdqJAVoGIyZqSH/XBbExnlQJ2k1hwHIhC4fHf:ePS41giv+q+VRBZq8/RbPwHAP

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

121.89.201.85:44444

Targets

    • Target

      a6bdfb7e8e9933bb7784ca2a3332838687b6872302fd7c5487374f3aacf68457

    • Size

      2.0MB

    • MD5

      aae6059d749615e36e4f93d5751faadc

    • SHA1

      bc1619075d21a4e153ee1cf1356f7c1e9000c5e3

    • SHA256

      a6bdfb7e8e9933bb7784ca2a3332838687b6872302fd7c5487374f3aacf68457

    • SHA512

      70a2995de5662a90fca59d085017dcc95b886010e34a1dc8f8c04e2f712a268bb09b8374dbb90489e76fda25b570a97de8ba5e0a03ff900d234836d8aa92aba2

    • SSDEEP

      24576:ets+S6JFH0kO0gQpKHOrCdqJAVoGIyZqSH/XBbExnlQJ2k1hwHIhC4fHf:ePS41giv+q+VRBZq8/RbPwHAP

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks