Extracted

• • Target
    0531f71bdc212a056713b7e98e3977cf_JaffaCakes118
  • Size 255KB
  • SHA256 1960b1006570ac63af82c3fb1b307c17b2412b6257b5c6450439d103c1896f34
  • MD5 0531f71bdc212a056713b7e98e3977cf
  • SHA1 e53f74ad0006fd1760d83dc422775a44766b0ad5
  • SHA512 4c341399fa3f2ea5c9e97d960878e288dab79f78130ef11bc269d41b6e2737bb37de5c1d089fd3a41eaf0381c4f2836304a4e97185f9c914598d1d280931740e
  • SSDEEP 3072:LHxv5TKZ7aMyIpRxHJzqSPgoaOZRE7pRS56dXrv2sQC3YzHkyjZaFpV0oiZEiEQJ:1v5T1MfplL+O2vSYeEOZiSoguQn+tBZE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  metasploitbackdoortrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2