Trojan:Win64/Metasploit.CRTD!MTB

Trojan:Win64/Metasploit.CRTD!MTB is a malicious payload that is based on and shares functionality with the Meterpreter component of Metasploit. It acts as a complex remote access tool that can connect with the threat actor’s C2 servers via various channels such as standard network sockets, or HTTP or HTTPS transmission protocols. In a typical launching mechanism called the staged model, a small initial payload is sent to the target. This initial code contacts the C2 to obtain the complete and more malicious Meterpreter payload which serves to reduce the initial detection surface. 

After the payload is successfully obtained, it uses its device application programming interfaces (APIs) to allocate memory, often in blocks of approximately 1MB, and writes its binary instructions to this memory space. The payload then does not launch a new binary file, as this would be observable by process monitoring, but instead creates a new thread in the address space of a legitimate and trusted running process, such as a core Windows service. This technique is called injection and makes its malicious apps appear to be benign. 

The payload's key functionalities include runing arbitrary system commands, transferring files to and from the infected device, capturing real-time screenshots, logging user keystrokes, and harvesting credentials from device storage by loading specialized modules. Threat actors can extend their capabilities to conduct internal network reconnaissance, set up port forwarding, and escalate system privileges to gain deeper access. 

A defining characteristic of this threat is its fileless nature; it resides entirely in system memory (RAM) to avoid leaving traces on the storage drive and complicating forensic analysis. However, the initial infection vector involves downloading temporary files or scripts. The Meterpreter payload itself does not automatically modify Windows system files or logs to maintain persistence, but threat actors can deploy persistence mechanisms, such as scheduled tasks or registry modifications, to ensure the compromised device remains accessible after a reboot. Its activities are designed to blend with normal device operations. 

The C2 infrastructure is wholly configurable by the threat actors. Documented command and control servers used by this malware have used the ip 179[.]60.147[.]4 on port 58731 and 108[.]62.118[.]160. Test and development threat actors often use local internal IPs in the 192[.]168.0[.]0/16 range to simulate attacks and exfiltration of data in a controlled environment.