Extracted

• • Target

    c1bf0dac217e92042230b3012e8a5c8a_JaffaCakes118

  • Size

    92KB

  • MD5

    c1bf0dac217e92042230b3012e8a5c8a

  • SHA1

    c5bd0a131f21f30a154bb13f68d7dcfbc5163ecf

  • SHA256

    fa60c7453f5760a0961c429ffba2f6da85a9babab44d81543f7dc5d601c2e23b

  • SHA512

    68f5461f3d6335672d17d745e50ad8d6ba76e4f03e4e35ba8213f2503e002ba1df86f8eedefa53584b4779660f6c2956282c17b2b7add788355f66f0758804d0

  • SSDEEP

    1536:mSquE20GQV1KOrdcxj1PNYxa/alX426rS8u7kl2xCeotMWT1MW9I23:5kKOrSj1lPMXLkiCeoFMn23

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2