Extracted

• • Target

    0186cefcac83d88162574f005c405f8c46ef860fd5bbdffb24cac0ea18567a9f

  • Size

    154KB

  • MD5

    29fce963d4fbe9aab3f6d1c514e82141

  • SHA1

    3f9a7377c1ab2a1964aaf0ac72557d715c776f71

  • SHA256

    0186cefcac83d88162574f005c405f8c46ef860fd5bbdffb24cac0ea18567a9f

  • SHA512

    825335e7d803841aa81ab70168868322baef9d993f3bc3a7963d0c2334465ef1673c50eb709bc47ccb3df9a9979781ee8068c3602be1bce6c70a15b61e688ec3

  • SSDEEP

    3072:OiPZmCkJf5Pb5AMAEb63RTz5jTpwSrrnnpi8kxtv8QMZlXo5:OiPdQQ+CRvVTpV4Rxtv8Q4Xq

  Score

  10^/10

  metasploitbackdoortrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2