General
-
Target
JaffaCakes118_096f2351e53ac2aafd0b8bc9059e794e3150909eed1fd4d08f6e3f238cf042d3
-
Size
54KB
-
Sample
241229-g9qvmsvphz
-
MD5
dd60f7322c54eae0e5b28d9ca79750f9
-
SHA1
977384473210b19cfb4f7190228f793f2ff0b4e4
-
SHA256
096f2351e53ac2aafd0b8bc9059e794e3150909eed1fd4d08f6e3f238cf042d3
-
SHA512
8f7cc5c1c5e332a06739bd225ef655fd8fcbe5d80e03aa43fc3665ddf7128b93673b1d0726ea93b2f25460c86727ee22b67312115073098b5d9aca5d98fd0f97
-
SSDEEP
1536:9yqKTcFAZVFHcgn97htnPAGDSbvjTmlSaq0t3SfU3l7TBqalc:93KTpZrxvP5evjT05q0t314Yc
Static task
static1
Behavioral task
behavioral1
Sample
529628adb7ac898054e8276740e43941db3d4db065e1ee17f38b236daeace708.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
529628adb7ac898054e8276740e43941db3d4db065e1ee17f38b236daeace708.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
exec.bat
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
exec.bat
Resource
win10v2004-20241007-en
Malware Config
Extracted
metasploit
windows/download_exec
http://www.microport.com.cn:80/npE9
- headers User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; MAARJS) Host: ydzf.10086.cn
Targets
-
-
Target
529628adb7ac898054e8276740e43941db3d4db065e1ee17f38b236daeace708.dll
-
Size
80KB
-
MD5
f3b5443f08ddc69d78680977a806f315
-
SHA1
798e3ed264474ecf67719d3277667083585f78a8
-
SHA256
529628adb7ac898054e8276740e43941db3d4db065e1ee17f38b236daeace708
-
SHA512
5790713c65862acaf6311c90dadfe399ab385767b8f1e4ea938f5fd4a692577e40700f03c374adde74882c92b8ed41e4e12b7c58e183f09ee6636b2a285091d7
-
SSDEEP
1536:NkKIDKrg3J7Nnufg+g5wsLtQmlSaq0t3SfU3l7TBW/:NkKaRyg+g5wsLtQ05q0t31I
Score3/10 -
-
-
Target
exec.bat
-
Size
122B
-
MD5
bd39a2049859e5cf3890876b30ab85c8
-
SHA1
79d2ee0b07cc3fada05abec3cf08df48316437cd
-
SHA256
26063e345e4f1f6a9ddfb0993cbe7e983febbf6222026a61a3b57175875a3f16
-
SHA512
0db87abd20c055a3df1244ebcbf592194196dc7bd0d5a874df7775ee8c874dd3985f879a31f24c67991f470f81bb74f91830f8e31b8302dca8bb29d5b3fcfa91
Score10/10-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Blocklisted process makes network request
-