Extracted

• • Target

    a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118

  • Size

    155KB

  • MD5

    a0f1cd20775f9e1ed0b40fb9122f529f

  • SHA1

    639f8cd398fea2b12373c8ee4db5c3c6d7185517

  • SHA256

    f0279fe1b492cb8e9fe74fa7cedbf6de3adb6eb8106cfbc52cf4b1d4cdf27d96

  • SHA512

    483ab2ba34c301dad32e112813c52983362f103dd22fe7821184beab26f75854d2f86dcf436f93a23e8bd0e78b00509dac5dcf02ca81c1b698e5d10bef302ddf

  • SSDEEP

    3072:9a+huKQDjjM78IWjdJWZdSleKY5MG0inih23hGB2odHwQxswNoqMbFNN:9ZuKQDLIWJS+49vnXhGB2C3swUx

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2