Extracted

• • Target

    b7d3046bf47466ae1240e4ff4e02d0c95cc0a48ae330ce0bf335a296ae06ca49

  • Size

    266KB

  • MD5

    78e3ab7007a3dae96afccd388c869933

  • SHA1

    cb5c9c74004506500a6c4e5cb431e246bb8c0352

  • SHA256

    b7d3046bf47466ae1240e4ff4e02d0c95cc0a48ae330ce0bf335a296ae06ca49

  • SHA512

    c07fa9c94e0f59b795b821760ee2b72490af2b62bc4913c99c1ba17655be389ee91fa347de2ee3d8309911681ec0cab037fdc5417516b693cca45556a8b7c659

  • SSDEEP

    6144:LWQXbSjopWSmLvQzfhtFrvb8xu0moP/SHD9LufoJ:aAmspWSmLvChtFrvDDjRn

  Score

  10^/10

  metasploitbackdoorevasionpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2