Extracted

• • Target
    Photo23.JPG_www.tinypic.com
  • Size 152KB
  • SHA256 a645525176dc50a4957defdc3bb8a7dce27a64c099dfe6b2aeb00a9309266647
  • MD5 0521e318661e12962ec8241369f2168e
  • SHA1 0029f82f3d33d7f34eaa248eb3fd4d45bff5ef8f
  • SHA512 41093c8320126682846b75bec3c2673c740a5eed0471407e258feb63dbc58a103c2ffc290857079907b13b3d9edfa367b60566aac48676bb7f8fb9fc63643fa3
  • SSDEEP 3072:WbEM+BtAG0HrXABZIOY35GFUtEbBqqJKCPNsu9UKnti48j:6xGQDAHOGFQqAku36Mj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  metasploitbackdoortrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2