Extracted

• • Target

    9de03c3f10a1b677e351d4411795bea0351a4680bbfb8c40b738908351fd0fd4

  • Size

    253KB

  • MD5

    ba6ae46526460efae73f8381a1b6ce7b

  • SHA1

    d3b871a018ffa4bc7fc4f4ef95beb8ddd987ea78

  • SHA256

    9de03c3f10a1b677e351d4411795bea0351a4680bbfb8c40b738908351fd0fd4

  • SHA512

    ee4323b2faf93ab1aabf8b87b413d9b2a08a80bf277af7fc737d0880d419a148bd1e36471043846d53bdda44e8014ed308d157aad22b78cbdb9212469d8402b6

  • SSDEEP

    3072:mbCGx5WySeR9vfG+pXBc0TZlpCGKGPJhD6QkkrR9vjKNL1lk+m0nbqKE:Epx5LSeR9vlpxxP3D6HkrTgLQ+m0nbq9

  Score

  10^/10

  metasploitbackdoorevasionpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2