Extracted

• • Target
    9ac4e30831a692b6627213d0486e8419
  • Size 264KB
  • SHA256 75effaffcd1a042128086123d283c934564dc43e02397cabef0e580cc1ce5cf6
  • MD5 9ac4e30831a692b6627213d0486e8419
  • SHA1 6e6719fab91da626f9950f8042de56f93907fc50
  • SHA512 6a0b15211cb815ad2c344ba4f77ab4c134c2fb038d42242debde5124d7146ac23e5f2dfc1f136fc1542cd06e10d90773f3fc4a9bb84f0275346ef930e63ecbe2
  • SSDEEP 6144:qt4q7mxIfGE2TW6nMF9DAJF5JWvApxDbpNUs2V2kVlKApTEkkjxW:qt46fG1T1nMF9DAJWvAXLUs2V7VhpTEc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  metasploitbackdoortrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2