Extracted

• • Target

    ef8785365ce25c4be0e3efd880f8eb7f_JaffaCakes118

  • Size

    252KB

  • MD5

    ef8785365ce25c4be0e3efd880f8eb7f

  • SHA1

    e0a87ea3c4b95994a9f9d0def4c7a4e5bb7f5448

  • SHA256

    f9bf03af636d85249ffc3d6929546e2d619e3f05f829e820ecbccc08546c536a

  • SHA512

    6dae5d29328c91c089a4b2b1026226b7f3982d6b4ed04967fd4fefd24bbf6ca252c677518bde49fa3b3ab312634d80851594102b5c84390c2a2546ebe8cfe351

  • SSDEEP

    3072:GRuR5R8v3IYAfKRyKGxo9GCeSvgXFLxNNfSumm38oeI7gvERZ3vy4CDX+dBFbw:ikOv3dANxo00ILlfSPmMxDCZ3vyW

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2