Extracted

• • Target

    f75f1a3823e65508cd6910bedb971ce10dec903bdf36d8f999eaf97f8058587c

  • Size

    1.8MB

  • MD5

    2eb6e4524259c855508b55afc99d767c

  • SHA1

    f52f9227f9db7e062cb813a9a2fbe21d04087cca

  • SHA256

    f75f1a3823e65508cd6910bedb971ce10dec903bdf36d8f999eaf97f8058587c

  • SHA512

    36ab3041ad3c71b636bfa126751a60ed84f07664edca7b66768f77f112bbd3fe02e94ec92fe76386bfd903fe77ab0ddc00411b4aed02d79466d1f9c4d8d626d5

  • SSDEEP

    24576:/3vLRdVhZBK8NogWYO09IOGi9J6IAw7V57BfR27oJZuS1tkxdba8GuV6jwC/hR:/3d5ZQ1ExJ77Bfo7uZn1Sva8GuV0

  Score

  10^/10

  metasploitbackdoordiscoveryspywarestealertrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2