General

  • Target

    635b01bda7f9753ba72dfa5efed266f10addb19273eb2bcaf8d8cfd3c06d1fa9

  • Size

    42KB

  • Sample

    241229-16newsylfn

  • MD5

    c3e4d0f03ce34c94986741ae9cdf6104

  • SHA1

    38b95eb3bec13067f3b39d5daa048b68c1c25fbb

  • SHA256

    635b01bda7f9753ba72dfa5efed266f10addb19273eb2bcaf8d8cfd3c06d1fa9

  • SHA512

    cca4289314d939272acad2249a8e6824eb490c662c41ccc0059b054d69dfeeefd5c4b400a66f69eec2660927abb9cc815793d84b45dea6c8426b61756f36dcda

  • SSDEEP

    384:vIiSgq03gRhQ6+pek/iXppK6mLt56hrTd2ukyzQ/+DQSInrPS50jxSiKEotK:vG03gF+pekqZpi56h3W+bSSyjV

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://192.168.201.152:80/7ZSx

Attributes
  • headers User-Agent: Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)

Targets

    • Target

      635b01bda7f9753ba72dfa5efed266f10addb19273eb2bcaf8d8cfd3c06d1fa9

    • Size

      42KB

    • MD5

      c3e4d0f03ce34c94986741ae9cdf6104

    • SHA1

      38b95eb3bec13067f3b39d5daa048b68c1c25fbb

    • SHA256

      635b01bda7f9753ba72dfa5efed266f10addb19273eb2bcaf8d8cfd3c06d1fa9

    • SHA512

      cca4289314d939272acad2249a8e6824eb490c662c41ccc0059b054d69dfeeefd5c4b400a66f69eec2660927abb9cc815793d84b45dea6c8426b61756f36dcda

    • SSDEEP

      384:vIiSgq03gRhQ6+pek/iXppK6mLt56hrTd2ukyzQ/+DQSInrPS50jxSiKEotK:vG03gF+pekqZpi56h3W+bSSyjV

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks