Extracted

• • Target

    d6161d729217cd2a6983ef32a8020631_JaffaCakes118

  • Size

    68KB

  • MD5

    d6161d729217cd2a6983ef32a8020631

  • SHA1

    c8056ebe061fcc8a9e1d819ce6c6337a6d13ce5f

  • SHA256

    68b4617df580e51f78ceec845a7834229f2fb3739e0f71c3cbc0aadb0920cc4b

  • SHA512

    246f3808d12db5f0e6c6a742adcf7953e45879a2c6970016bfdaca4cdb61f60ecfaede142e9bb4517990e46bfaf9a2f373f699c4d738563ae1f082da580c40be

  • SSDEEP

    1536:4jrnJ1KXI4dI2bZtXH3aYRwr30Fpb+4D5K3TPVX:4iXI49bZhH3bCcpS4g

  Score

  10^/10

  metasploitbackdoordefense_evasiondiscoverypersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2