Extracted

• • Target

    2024-12-25_d17dc248fc4714da1b7dce6987892d02_avoslocker_luca-stealer

  • Size

    3.0MB

  • MD5

    d17dc248fc4714da1b7dce6987892d02

  • SHA1

    803c61130ab5ed2ecba9973cfa9051dc17884128

  • SHA256

    78352a58975a346f5c3f9d4056604163234a508d03635a72c76a69a07c7c4300

  • SHA512

    1665d3e16ae664b53f1efe5cfe84ecd8a751e22c807bd059108fb6f8fcd0b47b2317231b584c77806c6e685ffcb3e7771d9636f0198cc3eeed4ca3a44dc0dfbd

  • SSDEEP

    98304:91BfKEkYUJXqxpsDiSfgFKLT39QI3koVyQg3qL81bjR:cJhy8iSf0K39QIJg3l

  Score

  10^/10

  metasploitbackdoordiscoverypersistenceprivilege_escalationtrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2