Overview

overview

10

Static

static

3

2026-10-01...lc.exe

windows10-2004-x64

10

2026-10-01...lc.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-10-01_93df9d879b15362091698125568a5a82_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 438KB
  • Sample261002-kkzm2azerd
  • SHA256 7886bf19e1b3cc0c112a5db2026bb20c95c787d7346e850836d922ae854d8d03
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
metasploitbackdoordiscoverytrojan

Malware Config

Extracted

Family

  • metasploit

Version

  • windows/reverse_http

C2

  • http://demoon-sec.ddns.net:443/cl2PMZ4H06iGAocD7LneogPAua-MqehVfuCIZ3IS1wVjrKSa2k8izO00qPerAhqrtgVftwxsWZSt0Ol9x_jl_BkE2r1Vuji5DJz6AQ7YAbkNhKwaQG7B2iR68JsRZUg8J8H47ZMYZEslP-ifWuHQ5xZM-fZE-3JmS9hskT

Targets

    • Target
      2026-10-01_93df9d879b15362091698125568a5a82_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
    • Size 438KB
    • SHA256 7886bf19e1b3cc0c112a5db2026bb20c95c787d7346e850836d922ae854d8d03
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoordiscoverymetasploittrojan

    • Family: MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks