Extracted

• • Target

    1bcecabbef40751094ac983fd966f423

  • Size

    249KB

  • MD5

    1bcecabbef40751094ac983fd966f423

  • SHA1

    1336ba51e86b912a068196a0f40225f81dbd50cb

  • SHA256

    06cc1d370046906f8170fa2b0833efbf7a823d6479ca6db8ea3a5af3e16c9c05

  • SHA512

    d775dc0a7b50f155b94b213478a666223ff17b532252865f087d86b9801c8f459b43ecfca32c772a89f2aa0cac73d6169432b201c0f71470ec8ee2b4696a8b78

  • SSDEEP

    6144:x1S2TjP4CaompOQMgWmAtCYTVnvs6IHcMLtDO:x1S2PP4Cao7/TUKn06SVLVO

  Score

  10^/10

  metasploitbackdoortrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2