Extracted

• • Target

    854a65a1b3025a333f83a5b22c79d52e7fd2b2c5723370df21d089e080cee663

  • Size

    1.8MB

  • MD5

    05c9f0ea9f5301a15918ad4c2e05cf9c

  • SHA1

    19279fe38116b4ea273d486e8b2c5a792a5b3bed

  • SHA256

    854a65a1b3025a333f83a5b22c79d52e7fd2b2c5723370df21d089e080cee663

  • SHA512

    012f5bf29cc8158f9de9615c7e7c08eaefd93cc2747f6c6c236d53bf7f780cae2da3081d4888d5c8f9c1dd033ed7c5dc73e8769831f5e6b29a3f37d87e98281a

  • SSDEEP

    24576:/3vLRdVhZBK8NogWYO09XOGi9JbBodjwC/hR:/3d5ZQ11xJ+

  Score

  10^/10

  metasploitbackdoordiscoveryspywarestealertrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2