Extracted

• • Target
    DSC-NewPicture10.JPG_www.24x7filehosting.com
  • Size 194KB
  • SHA256 9406a9e12983fcbb9163819a51e803cf51d146674ab94ca423ec693206898478
  • MD5 d8719f4cf432be79b3ec6dc421d92981
  • SHA1 3552343bfcd58c52be0abcfa1ff179c3fe3c81b6
  • SHA512 24516a0755bd98458c2200b101092ba85a1a2cc098b0153cc339bbdfe8d908dc4d3468278d73eb7ae968f49415ecaac7e35b7770f359ffaa4f0d7bce05316c8b
  • SSDEEP 3072:lFaXOuiMdkZS4hSKETvfyC9fjVNUSY+n2u+lJZZRJfsZSuNayqdk:7aXOckZdSKEzfHR9YH93f8D3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  metasploitbackdoortrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2