Extracted

• • Target

    e10fe5997265abe21819bf7954f90a8a_JaffaCakes118

  • Size

    168KB

  • MD5

    e10fe5997265abe21819bf7954f90a8a

  • SHA1

    480ba8706f6f17be203f54e161a15491c061f16b

  • SHA256

    2e4439337d6e110c549cb61c6d8eab9c9c591f94f19a96c84397b4574f0a3ca3

  • SHA512

    33c6da8432ee4db94673475916d1f16067647589a91eee6e2426d905d334d7a64a379698589bb7da760f6928fd3c8ccd4dd3ae6258e514132cdf490cf82b719a

  • SSDEEP

    3072:YrNfo1ZfSD5LP3p4+OIyc6yF0Hl5aTrDq4oKnFwJIQq7WZ4UPhhC0F:Io1ZfAqKF0l5aTrbnyItihr

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2