Extracted

• • Target

    478c9e9e70389ed8e587dfbfb8abb07aed5b9b7a8ee1e471c0ea8a0e79097513

  • Size

    159KB

  • MD5

    48acf90968be209c5468707fb70799ae

  • SHA1

    f7704e957e9de6f4199d387ec3b2e862f684cec9

  • SHA256

    478c9e9e70389ed8e587dfbfb8abb07aed5b9b7a8ee1e471c0ea8a0e79097513

  • SHA512

    3cad4dc339051822e66ce0bb21319a602a5ffe5958a4ad622f17a9f1ef8266fd4983160ae1e5ae8b1688f11f3260047138abe4d8c6ca8bd5ca723589e584ef5d

  Score

  10^/10

  metasploitbackdoorevasionpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2