General

  • Target

    World of Tanks.exe

  • Size

    72KB

  • Sample

    241227-fmznlasjft

  • MD5

    b3520940042d52305df325050a95d98a

  • SHA1

    41c423785a528937a3761004327e862743071529

  • SHA256

    1d728a4c330add4b8a4196e1d698fd4c857a004ed5b51e5b97c6ddd5eb671490

  • SHA512

    1e5e9bbe3244db95bfbda1a770c813a73e84bcc869c1b34627fb0b971094d0421b134f92160681759288bbb9387441242924811ba463c8abb2fc6647d424eb8b

  • SSDEEP

    1536:IUdJOUmVE4Xre39aEk/oMb+KR0Nc8QsJq39:vdJ9mVESr2cEeoe0Nc8QsC9

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

192.168.1.4:4444

Targets

    • Target

      World of Tanks.exe

    • Size

      72KB

    • MD5

      b3520940042d52305df325050a95d98a

    • SHA1

      41c423785a528937a3761004327e862743071529

    • SHA256

      1d728a4c330add4b8a4196e1d698fd4c857a004ed5b51e5b97c6ddd5eb671490

    • SHA512

      1e5e9bbe3244db95bfbda1a770c813a73e84bcc869c1b34627fb0b971094d0421b134f92160681759288bbb9387441242924811ba463c8abb2fc6647d424eb8b

    • SSDEEP

      1536:IUdJOUmVE4Xre39aEk/oMb+KR0Nc8QsJq39:vdJ9mVESr2cEeoe0Nc8QsC9

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

MITRE ATT&CK Enterprise v15

Tasks