Extracted

• • Target
    78e3ab7007a3dae96afccd388c869933
  • Size 266KB
  • SHA256 b7d3046bf47466ae1240e4ff4e02d0c95cc0a48ae330ce0bf335a296ae06ca49
  • MD5 78e3ab7007a3dae96afccd388c869933
  • SHA1 cb5c9c74004506500a6c4e5cb431e246bb8c0352
  • SHA512 c07fa9c94e0f59b795b821760ee2b72490af2b62bc4913c99c1ba17655be389ee91fa347de2ee3d8309911681ec0cab037fdc5417516b693cca45556a8b7c659
  • SSDEEP 6144:LWQXbSjopWSmLvQzfhtFrvb8xu0moP/SHD9LufoJ:aAmspWSmLvChtFrvDDjRn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  metasploitbackdoortrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2