Extracted

• • Target

    c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339

  • Size

    1.8MB

  • MD5

    b63d033a7af7588d7c5ba60068d81e48

  • SHA1

    0b8fba25bdee3f5f4e8c008f1bdeeae39e7128f1

  • SHA256

    c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339

  • SHA512

    895b4b199c8155d50b8b2830c9b266ef3a9f9a8e43c44c65b3897a78a14616f0cb925c33f714cfcffbb3fcde7888296273d65fca1ee4ec9b496a34c233a142a7

  • SSDEEP

    24576:/3vLRdVhZBK8NogWYO09WOGi9J3YiWdCMJ5QxmjwC/hR:/3d5ZQ1+xJIiW0MbQxA

  Score

  10^/10

  metasploitbackdoordiscoveryspywarestealertrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2