Extracted

• • Target

    ebee1cd2f4edbbc041a0eea7afa06717_JaffaCakes118

  • Size

    92KB

  • MD5

    ebee1cd2f4edbbc041a0eea7afa06717

  • SHA1

    e6c967759914472bbb04c9c6fdebf91e5e627861

  • SHA256

    123b0c374fc68a937672af9693d2a8f076ba3f9fb77e240d83301494c2d327c1

  • SHA512

    d4534fdacedd648c56e72be23fbe0cad58ff9c6e7ec60986c419e643569c77d2acb72d6f24710c1cc55151c4b49a8298026feb0625e88a6cf69fba02ef75fdfb

  • SSDEEP

    1536:KSquE20GQjoG3OIXgR5ecROWewiuohpquSh8/wDJFN3l4AH+17PMwdVCpb:NzG3C5ecRZewiraxG/0g++17PMwKb

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2