Extracted

• • Target

    e855189df35fa64d5760036d14793f90_JaffaCakes118

  • Size

    261KB

  • MD5

    e855189df35fa64d5760036d14793f90

  • SHA1

    5eda5d7a26280b684cd4514c554b646893eb8d47

  • SHA256

    3b5cf35562c1092214688cca98fa273d3ded5b3d7eba5855a935ffd0b8e9db56

  • SHA512

    aa53c16ee21fa2aacf7daacc57d8fa5f702c6e033cc777a6692727a84f1b5b2225c522e7cda30355d65b5d46d3030db6b76b833a49f9246c2422146895869629

  • SSDEEP

    6144:CbsUESHsRQKfwZgXhsoTDiKf5zHEXL67ubpXd6F:C4UESMRQuYUHi45TE767Yd

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2