Extracted

• • Target
    854a65a1b3025a333f83a5b22c79d52e7fd2b2c5723370df21d089e080cee663
  • Size 1.8MB
  • SHA256 854a65a1b3025a333f83a5b22c79d52e7fd2b2c5723370df21d089e080cee663
  • MD5 05c9f0ea9f5301a15918ad4c2e05cf9c
  • SHA1 19279fe38116b4ea273d486e8b2c5a792a5b3bed
  • SHA512 012f5bf29cc8158f9de9615c7e7c08eaefd93cc2747f6c6c236d53bf7f780cae2da3081d4888d5c8f9c1dd033ed7c5dc73e8769831f5e6b29a3f37d87e98281a
  • SSDEEP 24576:/3vLRdVhZBK8NogWYO09XOGi9JbBodjwC/hR:/3d5ZQ11xJ+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  metasploitbackdoordiscoveryspywarestealertrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2