Extracted

• • Target

    150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445

  • Size

    574KB

  • MD5

    6cded01b63fa3a3bd8a9ad88b3ebcbb6

  • SHA1

    97450ff3b0e6f0ec33cef13f6b203e14423fcf9b

  • SHA256

    150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445

  • SHA512

    2c7b52f7ed561c8026a4eb9a6ee04fadfdd5d0f83be3439596b5bb8f0f05d90718306bf6d05e8bfdf310e866e26d4f079fcbad17b5e5fcd794efc930d4011f8f

  • SSDEEP

    12288:0QpNPhKo149mbgiR2zPMXxMVEkuBZuO9yjREt:Rb5Co0zkhoXuaOQ2

  Score

  10^/10

  metasploitbackdoorevasiontrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Deletes itself

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2