Extracted

• • Target

    346904d8e0bb829b043f2a83977700d1_JaffaCakes118

  • Size

    140KB

  • MD5

    346904d8e0bb829b043f2a83977700d1

  • SHA1

    274f6a0f70e06b818047ed1f74d2f96c53c5afef

  • SHA256

    33dceac539b2a81f97477eb7f2c140adcabaae7a8a920f10db3593fca147dd54

  • SHA512

    ad7c3015bd37ccd31016b97f3c9a3a37afffdc7ddb0fa1ce813b5a2e36c5eed93bd265b16568eb08ad0c7371d120b38d128e3254f945b5987707d3d152a0fac5

  • SSDEEP

    3072:Eb6598JqTHvNcAvuSD97v1bXwJ8m34xWL5pG4BYf:qo7NJz91MJ8BxOpJBYf

  Score

  10^/10

  metasploitbackdoorevasionpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2