Extracted

• • Target

    dc9eb54ed1c3e7b99c207128a76f8ebc_JaffaCakes118

  • Size

    198KB

  • MD5

    dc9eb54ed1c3e7b99c207128a76f8ebc

  • SHA1

    a76f058783b6918e802d492af5adc50d05b251d7

  • SHA256

    23306f0640e23f2487febf1c35be79487c5453fffe38c30ed40d3ad879b6132f

  • SHA512

    66c3b0790823c4614c17cc554287ec0d434338f5156f18f7a2edaee33e43a3b1cf983b8b1dbaccf8dc0a7ed7682e9150722e4e98c0e6127b548619892394b662

  • SSDEEP

    3072:8boQs34PiJiFX/Zb5L1odA77vsDUUbjTcisIJoldaLGdWHPSn98gDDcuO:8S34HedqY1HT/sMopQw8gDDcuO

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2