Extracted

• • Target
    939ee3fe101534a4f62dfb159da958e1
  • Size 239KB
  • SHA256 818b5257f61e7ccc2876a9e6ced05c1c9ceca7d4fce2ff3e113c351a7afe922a
  • MD5 939ee3fe101534a4f62dfb159da958e1
  • SHA1 3124c88254b572ea5fd6f2a1a00eafd296b34d8f
  • SHA512 af970103bc8ecdba2e92c6321b927e05053c0fd89523fa1681ce112818eaf57d8a6a36f68c4f3b00956717ec2640490379ea67fa04d01248a0914c91263850c2
  • SSDEEP 6144:tzKa3Tta4VWkXQGb53FiDku7Kb8PFO1tsMYYjguE0ieJ:9KsU61XRFek0gIs1yMxjWi
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  metasploitbackdoortrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2