General

  • Target

    JaffaCakes118_ff0075614aef2139ef9905f517576f5743493353df7ad701d2968e5d67417581

  • Size

    5KB

  • Sample

    241224-c5a66szmgp

  • MD5

    cc1600c84b37e8aaa18e646467b10067

  • SHA1

    7759a056d5f60a31dc44bff38e671025e4b818f6

  • SHA256

    ff0075614aef2139ef9905f517576f5743493353df7ad701d2968e5d67417581

  • SHA512

    9eb30f08ec7b16707f285f4b7757e340511e2b7cff5ef192fdb9fd589f2215a3f9153a5481c71894d634c6ef9e21a6365a490a33b4736bd7ef8248cc96ba4f20

  • SSDEEP

    24:ev1GSFGFajE/K3tQ3zSaJ2IkM6Pv617s3h/LjpKpuMA61hIAJu:qFGFajFK3zSIe7h/TMp1xJu

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

3.130.209.29:17251

Targets

    • Target

      JaffaCakes118_ff0075614aef2139ef9905f517576f5743493353df7ad701d2968e5d67417581

    • Size

      5KB

    • MD5

      cc1600c84b37e8aaa18e646467b10067

    • SHA1

      7759a056d5f60a31dc44bff38e671025e4b818f6

    • SHA256

      ff0075614aef2139ef9905f517576f5743493353df7ad701d2968e5d67417581

    • SHA512

      9eb30f08ec7b16707f285f4b7757e340511e2b7cff5ef192fdb9fd589f2215a3f9153a5481c71894d634c6ef9e21a6365a490a33b4736bd7ef8248cc96ba4f20

    • SSDEEP

      24:ev1GSFGFajE/K3tQ3zSaJ2IkM6Pv617s3h/LjpKpuMA61hIAJu:qFGFajFK3zSIe7h/TMp1xJu

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks