Extracted

• • Target

    0eb8849564cce6ae74801f923bc97e52.exe

  • Size

    538KB

  • MD5

    0eb8849564cce6ae74801f923bc97e52

  • SHA1

    77e70d251573396481e0305908a83aa12082699a

  • SHA256

    434782669aae645047f93e2c0594167286f83633f25b6ddfefbe4bd3edfeb914

  • SHA512

    1bbd2627897dfe55574522408b15d86466bd8706dfdba9af9abacca22e11f9c11547dc7120545bba86e459bc18ec5f9cd3402ca9feb971891a7947c1311d082e

  • SSDEEP

    12288:+NuaIsd+lbShO2PLOHKwsYyHBsU6lxSnyYxYKSCh3BeQs8D:+oaIzDWLO/sYyHBp6in1xcCh3BeQs8D

  Score

  10^/10

  metasploitbackdoorevasiontrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2