Extracted

• • Target

    db159bf301b961b164f70df516b567eb_JaffaCakes118

  • Size

    125KB

  • MD5

    db159bf301b961b164f70df516b567eb

  • SHA1

    4cdfb1dcc8b12233d44e89920c0dd0755864ba63

  • SHA256

    87ba2f400592ade11f865283e3b22300808435b4e042babe3342a6bc3ce34570

  • SHA512

    3385f00bca21720e65a08bea99b718e118c2a9242b597d4a7210680445a0977356cb26a526aa2c242e269d21b73729fc79034dbd5138ea9db8b056e930b846aa

  • SSDEEP

    3072:owrNwsrQjlv7xDL/vyfX+HH/HpU8vb2KJJ:owRvrM7hL/vyGHH/pU8qY

  Score

  10^/10

  metasploitbackdoordefense_evasiondiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2