metasploit | 220768857597518bb92de1f44ac8c0c409d1f2a8e8ebd2e1e23b508d5d2f0292

Sharing

Copy URL Twitter E-mail

General

Target
220768857597518bb92de1f44ac8c0c409d1f2a8e8ebd2e1e23b508d5d2f0292
Size 146KB
Sample260924-d4rm7sdb48
SHA256 220768857597518bb92de1f44ac8c0c409d1f2a8e8ebd2e1e23b508d5d2f0292
MD5 29e8c7a5c4232c9c47e4a8f9845691c1
SHA1 e52b86405ebb88d5ebd6c8cb6c339854c061e13f
SHA512 63b167cd67750fee496bdf854f088aa9ab6c608ea9744b91557e6acc8ae5843bca4e06a1001fa06a8fd56c0b422d23506e831530318df6bfeee4af57a6c1efd3
SSDEEP 384:dGT/m56XvPE05u3ikWr9vU6ygCD2XYhHwPhK57v07MByD23YZF7Q:dmm6XE05u3ikWr9vULVyiGh2AIByDrv
TLSH
T1BBE3E865E932FA05CB8F243D24849C6F859B1E285FF146EFC3908B1D454AAC0577E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan backdoor metasploit

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

http://www.sseekk.xyz:443/Events

Signatures

Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
220768857597518bb92de1f44ac8c0c409d1f2a8e8ebd2e1e23b508d5d2f0292

File Explorer

220768857597518bb92de1f44ac8c0c409d1f2a8e8ebd2e1e23b508d5d2f0292

.exe 146KB

220768857597518bb92de1f44ac8c0c409d1f2a8e8ebd2e1e23b508d5d2f0292

IMPHASH f4662192d439675bc107a140d5b87acf
SHA256 220768857597518bb92de1f44ac8c0c409d1f2a8e8ebd2e1e23b508d5d2f0292
MD5 29e8c7a5c4232c9c47e4a8f9845691c1
SHA1 e52b86405ebb88d5ebd6c8cb6c339854c061e13f
SHA512 63b167cd67750fee496bdf854f088aa9ab6c608ea9744b91557e6acc8ae5843bca4e06a1001fa06a8fd56c0b422d23506e831530318df6bfeee4af57a6c1efd3
SSDEEP 384:dGT/m56XvPE05u3ikWr9vU6ygCD2XYhHwPhK57v07MByD23YZF7Q:dmm6XE05u3ikWr9vULVyiGh2AIByDrv
TLSH
T1BBE3E865E932FA05CB8F243D24849C6F859B1E285FF146EFC3908B1D454AAC0577E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69667

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\admin\Downloads\Dumpert-master\Dumpert-master\Dumpert\Debug\ABU.pdb

kernel32

WaitForSingleObject CreateThread VirtualAlloc FreeLibrary VirtualQuery GetProcessHeap HeapFree HeapAlloc GetLastError GetModuleHandleW GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WideCharToMultiByte MultiByteToWideChar RaiseException IsDebuggerPresent GetCurrentThreadId GetProcAddress

vcruntime140d

__std_type_info_destroy_list __current_exception __current_exception_context memset _except_handler4_common __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_LoadLibraryExW memcpy

ucrtbased

__stdio_common_vsprintf_s _seh_filter_dll _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit _controlfp_s terminate _wmakepath_s _wsplitpath_s strcpy_s strcat_s exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __setusermatherr _set_app_type _seh_filter_exe _CrtDbgReportW _CrtDbgReport _exit __p__commode _set_new_mode _configthreadlocale _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc wcscpy_s _set_fmode

Name

.textbss

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

282B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

265B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rdata2

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

220768857597518bb92de1f44ac8c0c409d1f2a8e8ebd2e1e23b508d5d2f0292

kernel32

vcruntime140d

ucrtbased

generic