Extracted

• • Target

    c0e5c2b62d47728b11de9bbd9411f287

  • Size

    232KB

  • MD5

    c0e5c2b62d47728b11de9bbd9411f287

  • SHA1

    a95e8de5f747018729f10bd29c8105382952d8da

  • SHA256

    8c0b64250cc45b6355e000c19f84277ed36c82db1ee2a7a0b1b7b61715f637c8

  • SHA512

    f87ea7ece09df6d2652cd566fbeb3b37d8277e8edd0d1ec8a5cfbd969261105447a95ea874a1a0b167539b445f6964edb4bacd70b8b5caa46134f12333aa68a7

  • SSDEEP

    3072:iS9RUUb0IYRCN5PJRayrDQJzYqr0zJDITKbhduOToZlpK0IMgmVEx+hRF4q5ETF:TblYR2TwyX4YqrUIOXYnWM9Kqgq5E

  Score

  10^/10

  metasploitbackdoortrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2