Extracted

• • Target

    7aef4287918d399b55b1257c5adb08d006c1762254d1839d690ca325bf1c8eff

  • Size

    254KB

  • MD5

    9eb192f5718453471f5ab9bf7eeaf80f

  • SHA1

    8478bc1c3f2adb0fd74d9494040b51722ee1038c

  • SHA256

    7aef4287918d399b55b1257c5adb08d006c1762254d1839d690ca325bf1c8eff

  • SHA512

    60e89438aea0fd59572744ae97bcfd02fc5283199ab021d44df93c53cb7a9f04570d1bfe29624d94a5885692d8c8e01f86d053af93f835afbc8db4d3dc4195f7

  • SSDEEP

    6144:O4jHHMmjvSHclOyEpBkq7c1qIeiedDWeVLdGlllQlluIbVLcLqrjhIbvlllllllp:OinaHclvbQiyD//GlllQllBhIbvllllH

  Score

  10^/10

  metasploitbackdoorevasionpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2