Extracted

• • Target

    eea77f53df52609bddf7e7e3573d2c35_JaffaCakes118

  • Size

    247KB

  • MD5

    eea77f53df52609bddf7e7e3573d2c35

  • SHA1

    1ef9c9fc398acb14fc81c1ead788873857dfb13d

  • SHA256

    3d0a5e96a340e52b61359d6f68c441d18c726de97ee19a0ab60429c93a86ec79

  • SHA512

    bf7a49888fbedae4fb321b531cf990558108ffc637c1186b76ac2f87461f92d3ce9d507b58b412c6954f543d0df8f994b69350b96e5f5c0f9883902107ea2602

  • SSDEEP

    6144:TFBngH8Lfdx2mnKimeFZhr/2GfvQ3Pv9wuFv9R/YQ8VDec1/d2j:T3gcbz2mnKimexr/6zHyQ8Qc9Ej

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2