Extracted

• • Target

    97486c3b7548872c4acae2d64bb23410_JaffaCakes118

  • Size

    211KB

  • MD5

    97486c3b7548872c4acae2d64bb23410

  • SHA1

    ec87636087fcdb3a04f3757ff6a897d1d2bbd9e8

  • SHA256

    d486087baeb5eec86645bd62653f57f7bd07d66a91aab4e41e1d105b36d62cd9

  • SHA512

    e30362850553477cc8d2c601bf3cff5155794b71ca9ec91ac2eeef45c8d48241515e8b3bb917f8c7aedca10c3c4de92a34bbea87b86d537d4a1d2833557a2940

  • SSDEEP

    3072:IjdGs+CJi8bEE5Wvwc6A8yqxvyFmVDVs3srLujcigfNtEP64p/RWaTdkHNY2Cxa:IP+nvwhNBV1LhfrEPtpZWwktY2Cxa

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2