Extracted

• • Target

    ef08c4b337a4aee8adabbd4d9197566f_JaffaCakes118

  • Size

    244KB

  • MD5

    ef08c4b337a4aee8adabbd4d9197566f

  • SHA1

    d6739a74ec4c85de2170b2d57ffe61cf3fffc6b7

  • SHA256

    52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654

  • SHA512

    875206f79b7bcffbf55f03a439bf71dff8c1d4bfb0efa6d8a92745c5777867599a5fb1e444ac9c077b76f83aab0f9b42d53c2a1232904299c8956a420a1fe113

  • SSDEEP

    3072:VQwmJiJeCWZvRDFgJV0YWh0KtbjJUMf3Ya0CzCRm:V8JkiY7K5ObQ

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2