Extracted

• • Target

    f50da061ba24d56e3121a2a9ad82402d_JaffaCakes118

  • Size

    293KB

  • MD5

    f50da061ba24d56e3121a2a9ad82402d

  • SHA1

    a895da1a7db8ed660fb707f0981328fde1388d73

  • SHA256

    bd52e6cb9f9f9cddcad91dd9a9574a74f007d66f3c1f72a4e7618ea17c2354cc

  • SHA512

    db7d85227c66d627d52c45bdc274fc0286109e9ed23f503833c130c629759c3b68404627aa241b5b8118cf9783ca3abd6d83c36f6cabd354f59d2e00a71c7d98

  • SSDEEP

    6144:E08wLkUthveqDaWM8HleuLPJ+FFWVaJOHO4TyQOI5JgpcvqNplc4F4bsVYexS:E08MkUDvwoeiPMFFJJCXT0Iw5p4brGS

  Score

  10^/10

  metasploitbackdoorbootkitdiscoverypersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Executes dropped EXE

  • Loads dropped DLL

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2