Extracted

• • Target
    e951ce3b7748d6d8d124c5837a9621e61077afe69e99b8cca07b44cc845c399e
  • Size 1.8MB
  • SHA256 e951ce3b7748d6d8d124c5837a9621e61077afe69e99b8cca07b44cc845c399e
  • MD5 7144481e876b213297d0e6410d0aaca4
  • SHA1 9b579722f79f4e1639a40388a9928c9ae1e8f2da
  • SHA512 8114f89929e95033184028d269059a4e9626fa16db3a2fcd0a657ac226ffb8706c18b760bd82e4d73261ab6e3cb3d6af1c5201e2f4f455be6bf3dcc0166033ad
  • SSDEEP 24576:/3vLRdVhZBK8NogWYO095OGi933YiWdCMJ5QxmjwC/hR:/3d5ZQ1Hx3IiW0MbQxA
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  metasploitbackdoordiscoveryspywarestealertrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2