metasploit | jaffacakes118_0724bb4cf2ca73f0a495a493d1de1d0d6a3e60ff94b59186916242826f6e3609[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_0724bb4cf2ca73f0a495a493d1de1d0d6a3e60ff94b59186916242826f6e3609.bin
Size 43KB
Sample260911-1r13faef52
SHA256 0724bb4cf2ca73f0a495a493d1de1d0d6a3e60ff94b59186916242826f6e3609
MD5 e7c5c493db70593b8d74d76407e480d4
SHA1 606d80ae50a121df2a387d9a7bf72b21843abfe4
SHA512 2ac88579d3d6199110afe8ca2e8400b29e123f07e5cd2c0886b5681c0e0f843c425912f64774cf8b2bd6a8261124377bca652556fb043f648cde438544f620e0
SSDEEP 768:9GzlVP1ae6bE1ShBz/KHGneyuGkkc/nyji9MuplO/MOOfDPDG3WWsLGgDRX2:9GzlVPjRQBCGPan70/MDPNWYDRm
TLSH
T1AA13F2998132CE1EC8ACC268D7BDCB66D151ECD4A31D758FE1B16204EFD17859C67C60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan backdoor metasploit

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

83.244.163.203:7788

Signatures

Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/windows11.exe

File Explorer

jaffacakes118_0724bb4cf2ca73f0a495a493d1de1d0d6a3e60ff94b59186916242826f6e3609.bin

.zip 43KB
windows11.exe

.exe 72KB

jaffacakes118_0724bb4cf2ca73f0a495a493d1de1d0d6a3e60ff94b59186916242826f6e3609.bin

SHA256 0724bb4cf2ca73f0a495a493d1de1d0d6a3e60ff94b59186916242826f6e3609
MD5 e7c5c493db70593b8d74d76407e480d4
SHA1 606d80ae50a121df2a387d9a7bf72b21843abfe4
SHA512 2ac88579d3d6199110afe8ca2e8400b29e123f07e5cd2c0886b5681c0e0f843c425912f64774cf8b2bd6a8261124377bca652556fb043f648cde438544f620e0
SSDEEP 768:9GzlVP1ae6bE1ShBz/KHGneyuGkkc/nyji9MuplO/MOOfDPDG3WWsLGgDRX2:9GzlVPjRQBCGPan70/MDPNWYDRm
TLSH
T1AA13F2998132CE1EC8ACC268D7BDCB66D151ECD4A31D758FE1B16204EFD17859C67C60
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

windows11.exe

IMPHASH 481f47bbb2c9c21e108d65f52b04c448
SHA256 5a8da1a3d01128e3bb0891f4c1cb53e68e9a940f47518bbb99b405af0b02327d
MD5 3468daaf36aad4b30cad828518e10e2f
SHA1 8fb86099268810a7cf174b0e0f816931cb04ad6a
SHA512 9ea97a0724bfb4bfed33b8ae939edc00f9073b431b51e418f8acf19257eab0cea467e838e625cff72172abfde8de5d6bc79ddec015405bd1d981e184d6767ff0
SSDEEP 1536:Is9MUCET3YGzroYuepF5EtBOBMb+KR0Nc8QsJq39:luEJ/pFQOBe0Nc8QsC9
TLSH
T19C73CF42DAC01431D066127D76B93AB59AB1F6FA3712C19B754CCEE6DFD1CB0A2223C2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37629

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

_iob _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs __p___initenv _XcptFilter _exit _onexit __dllonexit strrchr wcsncmp _close wcslen wcscpy strerror modf strspn realloc __p__environ __p__wenviron _errno free strncmp strstr strncpy _ftol qsort fopen perror fclose fflush calloc malloc signal printf _isctype atoi exit __mb_cur_max _pctype strchr fprintf _controlfp _strdup _strnicmp

kernel32

PeekNamedPipe ReadFile WriteFile LoadLibraryA GetProcAddress GetVersionExA GetExitCodeProcess TerminateProcess LeaveCriticalSection SetEvent ReleaseMutex EnterCriticalSection DeleteCriticalSection InitializeCriticalSection CreateMutexA GetFileType SetLastError FreeEnvironmentStringsW GetEnvironmentStringsW GlobalFree GetCommandLineW TlsAlloc TlsFree DuplicateHandle GetCurrentProcess SetHandleInformation CloseHandle GetSystemTimeAsFileTime FileTimeToSystemTime GetTimeZoneInformation FileTimeToLocalFileTime SystemTimeToFileTime SystemTimeToTzSpecificLocalTime Sleep FormatMessageA GetLastError WaitForSingleObject CreateEventA SetStdHandle SetFilePointer CreateFileA CreateFileW GetOverlappedResult DeviceIoControl GetFileInformationByHandle LocalFree

advapi32

FreeSid AllocateAndInitializeSid

wsock32

getsockopt connect htons gethostbyname ntohl inet_ntoa setsockopt socket closesocket select ioctlsocket __WSAFDIsSet WSAStartup WSACleanup WSAGetLastError

ws2_32

WSARecv WSASend