Extracted

• • Target

    b18d3fb4e7419b74a13d34262d432e6f37b19c816c017d1484138edd1c8a1923

  • Size

    66KB

  • MD5

    723f9c7ccfb3de84ff4fd44f6be15637

  • SHA1

    bd89e34502e0a002bd9a0273636789e9a0d07502

  • SHA256

    b18d3fb4e7419b74a13d34262d432e6f37b19c816c017d1484138edd1c8a1923

  • SHA512

    dce994555bbb19f3d38e21e9a2c0b966cf0106281ed67b2f294f5f898bc2a37b121c189010f60d42b8e42b1c8198dafb3119168eb2a7daeeb3f6dd5eff944d1e

  • SSDEEP

    1536:5jtkNsAAQrNNVjABaqoiSUwiI4/WNPdDbzReJ2/:5j2SQr6BIbUwpvY2

  Score

  10^/10

  metasploitbackdoorpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2