Extracted

• • Target

    e7dea41d39769ee236261318033022be_JaffaCakes118

  • Size

    187KB

  • MD5

    e7dea41d39769ee236261318033022be

  • SHA1

    e6c917b1e02d55a9588b27acdaca0730695410ef

  • SHA256

    d5b165042e2c9e33785a1afb4890aef9a3ab28288ddfc9bf9ec6e57344d9efde

  • SHA512

    086dc6eeb4edd260b0a5df9373afb9fd3181df2e10fed6ab041e084939830cab181cdd447b69f9adc92e687c069da0843726cb460a91f466c6b2930a97b615aa

  • SSDEEP

    3072:BUp2Xm85V5glkgjlkC9KBAsPJx3rRmS/EOqkvg+FouthaUJrXw8bGLnry:BwrXjadBAsz3cUSkoUoS4QjXIn2

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2