metasploit | 54aea7ea709cca7deedfeb9df53746ac2a5a1e0a99ca4b12ff5bf5ff55aecd94 | Triage

Sharing

General

Target

JaffaCakes118_967992e0e86863000b7850daac183ade
Size

528KB
Sample

250329-ynwmfaxxcz
MD5

967992e0e86863000b7850daac183ade
SHA1

10671516a96eea8d8dc59e0ec494d38e3fb8012c
SHA256

54aea7ea709cca7deedfeb9df53746ac2a5a1e0a99ca4b12ff5bf5ff55aecd94
SHA512

93c3901fcbc21c08c4fbdc6ac7be78c02ce2f59cbf6142e14e40869f4a6bc90880abf558a2d6a750e84097113da9f2f7d89814cd9aa6a56dd42c3c7a302c5f58
SSDEEP

6144:e7CO/Eg5vsaLCp0kjOphMm9RHYYT/3T9mI8VsFu8HEw6jz1zNngR46:6COcaLCp0qOpvRH9L8p8HGZO

Score

10^/10

metasploit backdoor defense_evasion discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

- Target
  
  JaffaCakes118_967992e0e86863000b7850daac183ade
- Size
  
  528KB
- MD5
  
  967992e0e86863000b7850daac183ade
- SHA1
  
  10671516a96eea8d8dc59e0ec494d38e3fb8012c
- SHA256
  
  54aea7ea709cca7deedfeb9df53746ac2a5a1e0a99ca4b12ff5bf5ff55aecd94
- SHA512
  
  93c3901fcbc21c08c4fbdc6ac7be78c02ce2f59cbf6142e14e40869f4a6bc90880abf558a2d6a750e84097113da9f2f7d89814cd9aa6a56dd42c3c7a302c5f58
- SSDEEP
  
  6144:e7CO/Eg5vsaLCp0kjOphMm9RHYYT/3T9mI8VsFu8HEw6jz1zNngR46:6COcaLCp0qOpvRH9L8p8HGZO
Score

10^/10

metasploit backdoor defense_evasion discovery trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Metasploit family
  metasploit
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Network Share Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

metasploitbackdoordefense_evasiondiscoverytrojan

behavioral2

metasploitbackdoordefense_evasiondiscoverytrojan