Extracted

• • Target

    04627ec1f1311855778f53157a070b7651fdaf078f9a8c93c93bac8515d761f5

  • Size

    1.8MB

  • MD5

    de3849b36f155f0c6b528f10529e5fc0

  • SHA1

    5c7c3a5a8c626139a0ff7596b5f5aa8b85e104d0

  • SHA256

    04627ec1f1311855778f53157a070b7651fdaf078f9a8c93c93bac8515d761f5

  • SHA512

    01f78615a10482ceb10be9ded0e0287f8b53ac30fa07da2b8ef45a01d4e2410cdd2de04770c00ee124abd54b48feddf5e3c8d38df83a1fc893fd5eb77149fb59

  • SSDEEP

    24576:/3vLRdVhZBK8NogWYO09aOGi9JbBodjwC/hR:/3d5ZQ1KxJ+

  Score

  10^/10

  metasploitbackdoordiscoveryspywarestealertrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2