Extracted

• • Target

    4ba66c48bb9ca845ef04f9403dddb0c8_JaffaCakes118

  • Size

    273KB

  • MD5

    4ba66c48bb9ca845ef04f9403dddb0c8

  • SHA1

    3e9df07694fe1fd509c676e620d2933ac7ace0b2

  • SHA256

    8703ad458ab2b5f81910a5e47cf5c07825407a420e53f328d511e24ead3090b4

  • SHA512

    a7a7d767a51847bfdbbdeb776da7519b778e4c51e6e371b5c5522c12f5318a77bc5d3e2e402275e7dd1647a9adb82af4dcbe846fb3930e09240ddfea3e6b9a21

  • SSDEEP

    6144:zhVj9/550vWgmd1gPDcWKW3Ot/HlGLhyTYVc/f2xBWGLXSRmaFACcDDC6NU2Jt2:zhX/UvWpdEUWet/lihnc/fWnbIiCcDti

  Score

  10^/10

  metasploitbackdoortrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops file in System32 directory

  behavioral1behavioral2