Extracted

• • Target

    e789546a9101fc93ff458fa70fa6b8cd_JaffaCakes118

  • Size

    166KB

  • MD5

    e789546a9101fc93ff458fa70fa6b8cd

  • SHA1

    313e4522372ed861ed3f29205d87cb3d786b099e

  • SHA256

    4a64560a729bcf9bf115449533d1f4b316a4f11bc398c45043c7bf91d7833e42

  • SHA512

    ea9cb9e513edf25dc0db61cadcae6ab8b27165d9bafda2d598ff15927856fca8be8318198dd5a374c4111f346638a396bab150432779cbd17bc9b02e9bf9af10

  • SSDEEP

    3072:EG5bIr0kj9Uj25CDsewtDtgbs4TQNryGhr1NveBKWOAsu:95KjVemP/N2Gh7WBqfu

  Score

  10^/10

  metasploitbackdoordiscoveryevasionpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2