Extracted

• • Target

    88f608cc8b962df435952230078c4953_JaffaCakes118

  • Size

    167KB

  • MD5

    88f608cc8b962df435952230078c4953

  • SHA1

    fade95d2e5f0f8f97674784fb68b874b076cde93

  • SHA256

    9a99dbe4da731295a5cada60b513471b9ad3c34b992889ab999ffe24765e2fff

  • SHA512

    cb2289b50e760e7ed52958c64ae66d20fbecd57d3d9a04617c9f81386739c2caddaf804a00aaa8ab4904a2601f62361e3fba48d139b585ff7d379edc69f904f5

  • SSDEEP

    3072:QGEEhtp++sy+rmGVCupPARbC4HbYObKhHvYVxWbtlmMMD8SVr6BhvDbZIVBUVB2F:QGvl4FqO4HsthHg1XD8Cr6BhvD9IVO2F

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2