Extracted

• • Target

    d962945b657eab0d6ce90e8c8bbde362_JaffaCakes118

  • Size

    47KB

  • MD5

    d962945b657eab0d6ce90e8c8bbde362

  • SHA1

    5d10e839b0c8b39e5a45b7b16f8d659f349d1446

  • SHA256

    5466e1b4be35e74837d9ade6d38f370bc3976116acda01fd8c0bd503c8e7a4c3

  • SHA512

    9842bc6966734ab3f5801e8ecabe4547fdf2fba4f595c2d510a196086415efe9f7e5746ec6067f29bb6f6d691fc3660ad50060d4938ac4e6368101241ef24344

  • SSDEEP

    768:LYRZfEpAaP+FFT7y2Hd0yw4dhGdHZ0iyGj9222E2sgE6n5fJkBhqM/luLpj2AS4n:LufAZK3yvyw4dhGxyu9t2nswn5fdM/l7

  Score

  10^/10

  metasploitbackdoordefense_evasiondiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2