Trojan:Win32/Metasploit!MSR

The essence of Trojan:Win32/Metasploit!MSR lies with the Meterpreter payload, which functions in either a staged or single reverse shell that allows threat actors to gain access via TCP, HTTP, or HTTPS protocols with encrypted communication. In the staged method, a minimal loader is sent, then that loader pulls the entire payload from the C2 server to limit the footprint first. The code of this payload makes system calls, such as VirtualAlloc, to allocate memory in memory space, which was typically up to 1MB in analyzed samples. The loader will copy its code from the payload to RAM and spawn threads to run the code without creating a new process; rather, the Meterpreter will inject itself into a current legitimate process, such as legitimate system services, to hide in plain sight while running.  

The method of communication is done through reverse channels where the infected host is the first party to connect to a known IP and Port and read in the packets in real time. In its basic TCP versions, the packets are not encrypted; however, the more sophisticated 2.0 TCP versions use RC4 to encrypt, based on a custom key. Specific functions of these protocols could execute arbitrary commands via shell, afford bidirectional file transfers, screenshot of all active and visible application windows, keylogging to acquire credentials, and loading the Mimikatz extension for password dumping. 

Network mapping, port forwarding, and privilege escalation are also included, allowing threat actors to pivot within environments. The examined instances offered no regular file drops during infection, as the intent is to use volatility to limit forensics while the delivery of scripts is downloaded from temporary hosts. The payload does not change any registry keys, but threat actors could add persistence to a compromised device, such as auto-start entries, via WinAPI calls. The processes could remain modified via an injection, so the threat actors cannot create obvious new binaries, and some examples even used injectors into legitimate applications. 

Command-and-control (C2) endpoints are defined by the threat actor; in the wild examples have shown C2 endpoints (maybe from some original, but unlikely) to include dynamic linking to IP addresses such as 179[.]60.147[.]4 on port 58731 or 108[.]62.118[.]160, and in reverses case examples test endpoints on local box could be IP associated such as 192[.]168.68[.]21 for staging on port 4444 and 1337 to exfiltrate. There are no static URLs tied to the application, yet still an original cued node may reference a dynamic server; samples have shown encryption keys contained custom strings for RC4, which sort of takes it to the next level compared to just using a known key method of evasion.