Extracted

• • Target

    df69cf7380402bfccf02b8e5039e53c1_JaffaCakes118

  • Size

    264KB

  • MD5

    df69cf7380402bfccf02b8e5039e53c1

  • SHA1

    8a7c33d9751fce1d1b508f584e835664d45f38d6

  • SHA256

    adcbdcfd4f688add943cfad152efab513f803c562a1cc18645309ba7430eeeb4

  • SHA512

    2388585bf702544bd51113a88d91e8a865d43e103c02ab016e205b5e47f7e63ce1ed8aedd293117544a602fb03aa9f94523e61e3770a73c7e4e7740034cc421c

  • SSDEEP

    3072:jbhhhL6fualD3twhb/V3yaZhcFvf/5pZ8OeJwaAj0s4X3CfAyCEnaJTo:jb3B6fualGLJUNfRpZHeJrseyopWa5o

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2