Extracted

• • Target
    90c523400fcb1d7ee14e26a91f5879d6
  • Size 140KB
  • SHA256 8f7c4e97f30a5dd1aacbfa2fc37966c08243450877492acae945c292c37bc92b
  • MD5 90c523400fcb1d7ee14e26a91f5879d6
  • SHA1 343a1490217f344529380fe35420e73be5186750
  • SHA512 fcf7426c3590a1e4d075d02a62b1bbeff9bdbe468d783a5354412922aa7c2c03c695aa29af1351797ef6cc3bd7ebfeee87b382441a826132e25e2cf32a1df055
  • SSDEEP 3072:4412lSkvhlNPVnkeIfZRuCLgqbZkq/XT5NFlu1uMBpzZ6X8o5c:j1899VkeIf+CLioT5NfupXt1om
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  metasploitbackdoortrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2