Extracted

• • Target

    7eeb83d06fdfe62783fcf9ecbb0348e0b4860867e8c9dfbe82fdec7f5e1c87e3

  • Size

    255KB

  • MD5

    8a97bd1972cca7c70bde218a0811c13b

  • SHA1

    b27879b9cd1658bc0e7b5b7a04ae0630b95b6437

  • SHA256

    7eeb83d06fdfe62783fcf9ecbb0348e0b4860867e8c9dfbe82fdec7f5e1c87e3

  • SHA512

    81bdecac9f10eb50af33c9bcf89caebeca2ae3b5feac509e50a6968f879ffc9f23c0a2403c09630de483133fd00f6b38161f37a1bfb50501f2ff8c0edd39b84a

  • SSDEEP

    3072:JkHuQMLUdqtNYqkBd+76jOrXolyYq0hvS0hm4iDDg+pgAQH4+/5Bn6fvRS+QMA:JgahY7kYfhvI4iQ+pmY+/P6fw+QMA

  Score

  10^/10

  metasploitbackdoorevasionpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2