Extracted

Extracted

• • Target

    evil.msi

  • Size

    156KB

  • MD5

    1903ff06ec34d96120e24db16c6ef65b

  • SHA1

    890189b37281bba028b683aa839c0af24510f21c

  • SHA256

    f6aef9e69682375816e23b0191acb1cd2952d73b7661c920f80fd425f7849068

  • SHA512

    af38753be6d53445aa77dc1f155d41aa918e9602beee79b45df64ac3838bc2be045c32bf461c971f8d60f228c381d318f2da48cc26308501715d8e367c0087d1

  • SSDEEP

    1536:Ek7KoRO8LBNqER3qyREuPwjwXp5PUR2n0wMb+KR0Nc8QsJq3UDj0D:v7Kx8Lr3qiTPwjGjUsDe0Nc8QsC

  Score

  10^/10

  metasploitbackdoortrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2