Extracted

• • Target

    3c35c9e5dbc9da75d947bdf576bd9c72b52d838a8481d0cb0e35fb0df34bf39d

  • Size

    142KB

  • MD5

    0f456e504124199ba06a65a967f4a829

  • SHA1

    a8b03487a0b52bcfd2987338337e842575bc78a8

  • SHA256

    3c35c9e5dbc9da75d947bdf576bd9c72b52d838a8481d0cb0e35fb0df34bf39d

  • SHA512

    1b5eb54cdfe918f93f1c81fa27746f79d6a17b696d2b8cef5f85c7afcba7e2e694154c92ab61e798a4e860656da8bc184fb87b7986ce1ba9fde8e130277f2a08

  • SSDEEP

    3072:NLrX4le725Pvs0AHpVNLjX7XBC6PX1V4qGgLh/47VlVRoas3gn:NLyPvs5JXPLBr34qzLqhlVp

  Score

  10^/10

  metasploitbackdoortrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2