Extracted

• • Target

    b1688493e393f433bd9ba23aae398d199b36e691cb111e7e0f90aeb2cb4b1b32

  • Size

    202KB

  • MD5

    80282dc9bb7fc6d740592e81e765397b

  • SHA1

    ce12f8d32f73ca230c69454d6a1758b1c28dae10

  • SHA256

    b1688493e393f433bd9ba23aae398d199b36e691cb111e7e0f90aeb2cb4b1b32

  • SHA512

    364310cabef6cf34e2960c364febf4a6932ce6d8b1a7f927ba65b70b3e2bd77c66ca38b7c0d9327c0e5090235a0ea6e12a2167b468f0fef16c97d6057b0c2a3c

  • SSDEEP

    3072:hdmO0+1JiNRHw7PXAhsRUJWyrMqvQttM/WXfZXGTj3VBt7pI6RsxdL:PSrRHw7UJWOQttM/Wx0j3VBFsxdL

  Score

  10^/10

  metasploitbackdoortrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2