Extracted

• • Target

    e6d6866e90902a708fc0cfea69bd028a_JaffaCakes118

  • Size

    1.5MB

  • MD5

    e6d6866e90902a708fc0cfea69bd028a

  • SHA1

    47c26e495eefb975f5145c4fe3899588b98c0d63

  • SHA256

    2dcab2ea2abcc183d351c27be4b0c01860ab6a4250c84f76132f348548117766

  • SHA512

    5a2b15cdc979ab16805ef4d143ec8c60416043649c2815adeb1031e62db65233b4c811c1a169138cb27c1cdf8e3e26852c54707af9766931748f481b5ec89632

  • SSDEEP

    24576:pxdC6cVrb8romUZJgWfqedOoqdIjXxQRkF1mpaq8xltMK0MuDwrefAXnYW9iyW:pDC6cb8Cdhq6jXrZxlW0reoXn

  Score

  10^/10

  metasploitbackdoordiscoveryevasionthemidatrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies security service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Drops file in System32 directory

  behavioral1behavioral2