Extracted

• • Target

    66e2924598475f91962b91d29feba8b83317dbaedac3ed1e077d79e4cac25ddf

  • Size

    170KB

  • MD5

    72d3478bd0c0f31ff0ca19bb096130a8

  • SHA1

    d86416279916cba2716e90264c082f9da2240c36

  • SHA256

    66e2924598475f91962b91d29feba8b83317dbaedac3ed1e077d79e4cac25ddf

  • SHA512

    566527ab20ce004fd397764b642683ed77fa3fabedd32e2e0d58ae0e6b4c530310152b6ffb1b265b2f8d5de3eb51c7cff6bffdf5bfbe2a045f0e0617bcaa5ee9

  • SSDEEP

    3072:SyPevd8s7ZeqSBlnb/YlSFc6yum7c3tw+T++Elaqurlc14lYdrKe439pdp:SSs7klBpb/tRyuVdwhl/urC1GY4L9bp

  Score

  10^/10

  metasploitbackdoorevasionpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2