General

  • Target

    b10673aae9980b1ab66a26e6330e2715c4beeeae2d4ff9ccc9fc9c1de8b8fb6c.exe

  • Size

    17KB

  • Sample

    241231-j51v6a1qbt

  • MD5

    a1482109c91e7108d52a1f1ad15f8a7e

  • SHA1

    075511343282d82f2910e430fb74ec43fc4c11e6

  • SHA256

    b10673aae9980b1ab66a26e6330e2715c4beeeae2d4ff9ccc9fc9c1de8b8fb6c

  • SHA512

    fbf5208dafd788c7183ea02af9c56767905e6b303a6b57e6e1eea40a5865fb72368d363fbcf2fd67af33a94ab732cab20e00985f574088f851592f3c8273da28

  • SSDEEP

    384:ZEEoLO56ayzcMj+M+XLpZ5NzylYg3w+awmc48EJaB5:GE8O56lcVM+XSYg3w+ucKaB5

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

192.168.1.74:443

Targets

    • Target

      b10673aae9980b1ab66a26e6330e2715c4beeeae2d4ff9ccc9fc9c1de8b8fb6c.exe

    • Size

      17KB

    • MD5

      a1482109c91e7108d52a1f1ad15f8a7e

    • SHA1

      075511343282d82f2910e430fb74ec43fc4c11e6

    • SHA256

      b10673aae9980b1ab66a26e6330e2715c4beeeae2d4ff9ccc9fc9c1de8b8fb6c

    • SHA512

      fbf5208dafd788c7183ea02af9c56767905e6b303a6b57e6e1eea40a5865fb72368d363fbcf2fd67af33a94ab732cab20e00985f574088f851592f3c8273da28

    • SSDEEP

      384:ZEEoLO56ayzcMj+M+XLpZ5NzylYg3w+awmc48EJaB5:GE8O56lcVM+XSYg3w+ucKaB5

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

MITRE ATT&CK Enterprise v15

Tasks