Extracted

• • Target
    02cb022f503bbef3b833f920dd8fb6c2_JaffaCakes118
  • Size 329KB
  • SHA256 3469692e0429097f567c960b9805a205c2b232fedb42fd47c2b0cc3a4f0eb00f
  • MD5 02cb022f503bbef3b833f920dd8fb6c2
  • SHA1 170a1e8bd5505cdd9f4a4f47459af755ddf5de87
  • SHA512 88819fa7ce289de87255d50706fdcbb45d29c296f8590b2ebd244990c7f768de730f8d3af4c1db5d8eca16f8fc0e05a37c62086625f13a3109828eba5faca0f5
  • SSDEEP 6144:YRxVstLI005DXHkS5ziFiSw23emcscfL1K/9jumJOh+ulgxHamaZUyRQMJGQgtgw:YRotLIDXEezipjo5K/NZkhpls6CyJG3d
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  metasploitbackdoortrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2