Extracted

• • Target

    e2a695764004615ce95eb2405f1e36b8_JaffaCakes118

  • Size

    50KB

  • MD5

    e2a695764004615ce95eb2405f1e36b8

  • SHA1

    3e3e19180adb273f882ef700feb870075524055e

  • SHA256

    89f652cf7ffbd3698f4f7ede5a53c638868706d24d3367a1a18f1b3e3806ad18

  • SHA512

    d57819978f592ec5e86442ae8c2c6af4d92bf5f6f5220ecde79c06e44cc9f8b55b575bc319be483ccd3e64142076877539d167188d7f95b20a3afed4909cac25

  • SSDEEP

    768:rmYhFpv5qL2K33/gXZlgQprcQEoM1xOPmazukZNNX9BM99OeQOH+mjhtoLvtQLyM:rj7Fv8iCQ2dl1Ezuz9OetfhtoJaPCe

  Score

  10^/10

  discoverymetasploitbackdoordefense_evasionpersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Blocklisted process makes network request

  • Server Software Component: Terminal Services DLL

    persistence

  • Sets service image path in registry

    persistence

  • Impair Defenses: Safe Mode Boot

    defense_evasion
  behavioral1behavioral2