Extracted

• • Target

    f573a71600e76c1c8031a4bdbe73f8a2_JaffaCakes118

  • Size

    186KB

  • MD5

    f573a71600e76c1c8031a4bdbe73f8a2

  • SHA1

    63f8c5e6649a0334db142b33848e976a1982ac61

  • SHA256

    89f940a414f3b0a75928caa9257d6c8871cf4ead5e41d656b1a14913ed4af781

  • SHA512

    1e7fba9f08571f031a825dc602529aab64746bb5339b9fde5074ff1e886533cf16ee312795cc1cdfbc3033d6260f3e5df4f74369c71646f956bfba63749dfc9f

  • SSDEEP

    3072:sUb0Ji2zWpP563QqHwvM50+BYqsRVxG8Mnda0c7iTbcmE83yS:rm3xHV+7A8MdhQ83yS

  Score

  10^/10

  metasploitbackdoordiscoveryevasionpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2