Extracted

• • Target

    5113d4d86384cf5c73282d805c1adedf26845845f3255d1a98e3ac7d41663a94

  • Size

    1.8MB

  • MD5

    dd9aaf77c4f13d745f0d26cdc50ddcdb

  • SHA1

    8b7d17101a72c24781db212dbe2a976cc59215b3

  • SHA256

    5113d4d86384cf5c73282d805c1adedf26845845f3255d1a98e3ac7d41663a94

  • SHA512

    a9877a2d62396c9eb73a13243cafef2d1fea74eab4d783b39013229d0ab171b92ef0fc669928ccd8a6dcad06f43f1bc487890bd51a6df9497a965cdcdc1c2202

  • SSDEEP

    24576:/3vLRdVhZBK8NogWYO09uOGi93o/NnIz3VCk36UWdm32y8adTXeDZC1gWCQxRjwW:/3d5ZQ1mx3uiDX36U+x25XCQx5

  Score

  10^/10

  metasploitbackdoordiscoveryspywarestealertrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2