Extracted

• • Target

    0dd189f8e1134f616ffebfc60ad54c8f

  • Size

    161KB

  • MD5

    0dd189f8e1134f616ffebfc60ad54c8f

  • SHA1

    52bce45b0cbf83be03fabc781cb840ffbde68cdf

  • SHA256

    12e3f24d1816d595c4f9256e7e72168476d3d6c9cfbcaa6eeca8ae35869eec6c

  • SHA512

    1fa3620e5b03c7641b8d3b323c2d2ba87377c26416b185ac5c8b46c59e5278909e79d866bd02a6348a1a6f02867d1ac0d76e5126bcec386f260bce62e3140f73

  • SSDEEP

    3072:a7zxE5x4T2z6mqgEy2WqSxKY8D4d61JVaCivXMhuKGax:a7Ix6mqY2bY8sd6V+v88KGW

  Score

  10^/10

  metasploitbackdoorevasionpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2