Extracted

• • Target

    e64538a29ccbf2c90951b26298b0f62f_JaffaCakes118

  • Size

    74KB

  • MD5

    e64538a29ccbf2c90951b26298b0f62f

  • SHA1

    583fcba028f6102b0cae6957a45a3638a3c8f7fc

  • SHA256

    5fc4847c9e52e535f7f38c319aab7c643cd267a90e734f93f325a571114c6ca4

  • SHA512

    a43478f6341dedc11af2e6cb57365c6851c8617c9aeaf02b7f36cf7b905fd35434a133ebc512928e2250ab21cf82aebca5a07d70aebd211ebcf3098edcbdfc37

  • SSDEEP

    1536:4tfkjZQLyknPgAWwC+dBYSjNhtbKR/dOuMT5uhu:C8rkPIf+XYs/lKX05T

  Score

  10^/10

  metasploitbackdoordefense_evasiondiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2