General
-
Target
svchost.exe
-
Size
112KB
-
MD5
2f000e0a52d6ee0c89f93fa5ab4c7e3c
-
SHA1
6e45db2cc4648a388fbd6f3d82c7da9c8e30187d
-
SHA256
cf1ebd6fb534d65dd0e8164db9693988d5a4a645dd044beba578ab25c0033e66
-
SHA512
d433bf1fa375511d86621154450ade0879ee2705e7117fe6be67e38a26294d4187663b47ba3119da1776bf0594d516833696b80a502ff87b92c115cf98a368c4
-
SSDEEP
1536:JxqjQ+P04wsmJCyfWxMb+KR0Nc8QsJq3+kk8YM7U1BEwox+L2CG7o:sr85CyOxe0Nc8QsC+kfYhHV2CZ
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
windows/reverse_http
C2
http://185.174.100.204:443/L7RZw57VJ-b1dfR0k_tCyQtB1fJI8WowHQJSk54rTfUI2od24XrEIUzV5WGzx5fD0nPOwbVMrUfjFtDSZ8s8FudwarDyt7dL8gMPumRtXRv_ondaA99DiB1AmQDhTROOEB5RNqoBUGF7RO1eVLkzN4bgXoa9mjeqRlP1HJkpzxwa-XWfCySg54DfgGxSZPQAlpmdrTQwiPTmXmZzxGfhQBf
Signatures
-
Detect Neshta payload 1 IoCs
-
Metasploit family
-
Neshta family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
svchost.exe
Headers
Sections