Extracted

• • Target

    6cd3d57928b711cae4e19a3a038860e77e78a0bc47de1e5210051bef49711701

  • Size

    827KB

  • MD5

    2fbcb583449013418c53d8b69744c293

  • SHA1

    eda483b723b87c00b26672c819dd94b542a1977b

  • SHA256

    6cd3d57928b711cae4e19a3a038860e77e78a0bc47de1e5210051bef49711701

  • SHA512

    8bb1825142157a39aa44b246e839b0ede12f1510540a3c2ccb3ffdb1c07ebfae07e08f761f845fef22541338f0e8dadb2fc617529b3fd4c1db19ab1b6c212a9a

  • SSDEEP

    24576:IxCsJoUkbWghHbV98RLNbeTIV7TUVOT3rGVB59:IAsJoGgJbV98/beTItTUEG/

  Score

  10^/10

  metasploitbackdoordiscoveryspywarestealertrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2