Extracted

• • Target

    ed2d38398f580a470b1eba9ddaa0f6e1_JaffaCakes118

  • Size

    186KB

  • MD5

    ed2d38398f580a470b1eba9ddaa0f6e1

  • SHA1

    5301684a5ac0fbeea47d0684294c2dcdd4c8ccf3

  • SHA256

    3e179843782d2f676722e4b927d9f190bf082fc5057d1d5cea7b418ad7f8bec9

  • SHA512

    c9da13618374b835314b61dec190a802cb22882bec0c760e12f28561a4d7ed112dd367007a442c0c89520b294ac5112f81fc655c91e3c727620f0af82eee4277

  • SSDEEP

    3072:h5yCdIJi3mQFzQ4578DSPLgapKNJqq+YysX1yek0fkXACeNyGd:B/LxPLgapKN5+3nXjeoGd

  Score

  10^/10

  metasploitbackdoordiscoveryevasionpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2