Extracted

• • Target

    12b5093e95f909623576cab833eb87e3bbea092ecdca2666bfcc894240ce86b8

  • Size

    249KB

  • MD5

    60d551e06325b94d108010b19bd3ecd8

  • SHA1

    c1f864b7607b0959f4f60cc4ac8b364f6781016d

  • SHA256

    12b5093e95f909623576cab833eb87e3bbea092ecdca2666bfcc894240ce86b8

  • SHA512

    a012307d48162b72e6f9092f84d257cdcace4ea5b5f3728b0e8b7a262be0c58dbdf979ef0e42e43ed7cde7b43f2e3ca514932ff0c74fb9dd90547c6b3e96455a

  • SSDEEP

    6144:z1S2TjP4CVov79pqG90mKgHsmwj5KERyu0ERyNiO:z1S2PP4CVov79Um7KgHZwNO

  Score

  10^/10

  metasploitbackdoorevasionpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2