Extracted

• • Target

    dc6d81e8897fa7a630446f358604b5b55d2006df923fde8a0d3495117e37430a

  • Size

    76KB

  • MD5

    3e139a52141b5095d8454225b2a06741

  • SHA1

    cf07fd790cf04bd6fe31b370280fb6510de9b0b3

  • SHA256

    dc6d81e8897fa7a630446f358604b5b55d2006df923fde8a0d3495117e37430a

  • SHA512

    18abfd1d66a532bf90602a6b3a7425858df7b7021e7bd58d2edc43448b5a8ccb4ba458716abc9f10c0822d7d46d854b8a05f130d7044560f8825e8e5c2ef5b07

  • SSDEEP

    1536:MXNGoSt/3TleJjulF0OrWaooVggP2qsKmxit:yGftLlq8BrPVggP2lg

  Score

  10^/10

  metasploitbackdoorpersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2