Extracted

• • Target

    e43fecc3b2ee9215d9a22eda66e1e705_JaffaCakes118

  • Size

    152KB

  • MD5

    e43fecc3b2ee9215d9a22eda66e1e705

  • SHA1

    1665c2e92ab70dcaf8ec6f2d4a1ea4b24dabac40

  • SHA256

    57f696f6e75de5fca5aa014ff6276503f16c6e6fe9c62480d1b6082d014c3b71

  • SHA512

    94e1b48bef46d2fab48574aabc897f82a120f826ebd21841d202b062ccbdda3def7e3ee248471c6cb65597a734ced0cf8526dd51b9e80910050288c5e7553085

  • SSDEEP

    3072:zsDqKOtDmxjpOOhQKqdQlRiXuU6Ow+2L5vb8K:BakCfRiemCL5z8

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2