Extracted

• • Target
    e5a4b41df7461382fd0abb49ac6f18813a34171a7a70fc380c38228412dede22
  • Size 1.8MB
  • SHA256 e5a4b41df7461382fd0abb49ac6f18813a34171a7a70fc380c38228412dede22
  • MD5 ebb51d98f6dbaf566f7ebd183e45a71e
  • SHA1 9fb60d3b6d75a887a63bfbd576e0939255af5614
  • SHA512 bc2a3105e6714a7e2b845de4ba0a4917f3d319b7c86704c894486794a182287f633bce7d81f2051c7f697de9ee3636f4784ed32d12e6bc4c8ec4e06e299e7b49
  • SSDEEP 24576:R3vL762VhZBJ905EmMyPnQxhe4j27l9BoUj3QC/hR:R3P6UZTHXW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  metasploitbackdoordiscoveryspywarestealertrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2