Extracted

• • Target

    _________----by__.exe

  • Size

    254KB

  • MD5

    e068ee33b5e9cb317c1af7cecc1bacb5

  • SHA1

    ef3d2563fa3e29c1be76a149ff91398ab9987775

  • SHA256

    b5ef16922e2c76b09edd71471dd837e89811c5e658406a8495c1364d0d9dc690

  • SHA512

    0dbed2b5019050a84b0e3590a49a713a51ab231d73796b4754afe731690d35fdc47f04f13e29235a25f5ffcb05433c0e2e00841143a916cbb132d432cded7b10

  • SSDEEP

    3072:rTAjnioLO7WpLyLNZ45OlTZHiKb8ljJ3ijAviJcfM698RyOiy12KJ3I4YgTl:r6nrD0ZvRcjcOiJ+98X2sYXg

  Score

  10^/10

  metasploitbackdoorbootkitpersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Executes dropped EXE

  • Loads dropped DLL

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2