Overview

overview

10

Static

static

1

GHOSTFACE ...s!.mp4

windows10-2004-x64

10

GHOSTFACE ...s!.mp4

windows11-21h2-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    GHOSTFACE __ MAKAVELIGODD - Goosebumps!.mp4
  • Size 11.1MB
  • Sample260617-t18ejsax4l
  • SHA256 f9621bfcdfcadccb455c372bb0a1edde75ca2f2a0435b4e35d65d7a7d3083f72
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
asyncratdarkcometmetasploitdefaultguest16backdoordiscoveryrattrojanupx

Malware Config

Extracted

Family

  • metasploit

Version

  • metasploit_stager

C2

  • 178.233.136.201:8080

Extracted

Family

  • darkcomet

Botnet

  • Guest16

C2

  • lcsk8mwnf.localto.net:6258

Mutex

  • DC_MUTEX-CA8V8VF

Attributes
  • gencode

    ikKZRTDdPWtl

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

rc4.plain

Extracted

Family

  • asyncrat

Version

  • Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

  • Default

Mutex

  • jamayqlgkuauxiuxva

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

  • local_host

    127.0.0.1

aes.plain

Targets

    • Target
      GHOSTFACE __ MAKAVELIGODD - Goosebumps!.mp4
    • Size 11.1MB
    • SHA256 f9621bfcdfcadccb455c372bb0a1edde75ca2f2a0435b4e35d65d7a7d3083f72
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoordefaultguest16discoveryasyncratdarkcometmetasploitrattrojanupx

    • Async RAT payload

      rat

    • Family: AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Family: Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Family: MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks