Extracted

• • Target

    f0f5cfee985630355bc175f987235b3066463f20b7ec16eb6fe480dfe0826932

  • Size

    2.8MB

  • MD5

    db1c6242f285f50771cad71249efd80d

  • SHA1

    33ce7a04e430f97b0f0e5222bd8aa1959f033df6

  • SHA256

    f0f5cfee985630355bc175f987235b3066463f20b7ec16eb6fe480dfe0826932

  • SHA512

    499cead59cf73e5cae73899153c900d1df792b2be45803f2a166fbbb8857f0097daaea617b219a3b90f039f6c81434379fa77ffadbae54bee9a7435b7af1501f

  • SSDEEP

    49152:ghf7RKIntJWvd0L20FlMqjNEEXUpr/wOli1hcEjqY4mZ/n:gN9Ed0pFlMEDX2rYwis/y

  Score

  10^/10

  metasploitbackdoordiscoveryevasionthemidatrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2