Extracted

• • Target

    d6edb56b37fd2fef68e326f06066937c_JaffaCakes118

  • Size

    250KB

  • MD5

    d6edb56b37fd2fef68e326f06066937c

  • SHA1

    61ac2d26e058f2a9c219b7219099e00cedb5fc0d

  • SHA256

    4e876bf933e2f7244904dd14950f3f7781e97a8e964838b6a2257055e5f14a33

  • SHA512

    990a454d667a701da56889db3d72fb566adfb41c691fd6fd0eb877374ed728469c1e506e5ed71ef92d4b7db0337362221feb942439a0dbf9306c0d5f596b2e1c

  • SSDEEP

    6144:e00ads/WnIufgOb6m/qNica8L9ATGbxzcOMCjFrl+:eJoeWn8Ob2Ach+qzcPCBrl+

  Score

  10^/10

  metasploitbackdoordiscoveryevasionpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2