Extracted

• • Target

    f6a2933c59673487002368c1dc413819_JaffaCakes118

  • Size

    204KB

  • MD5

    f6a2933c59673487002368c1dc413819

  • SHA1

    1ec1b5abb7aa5e760ead8364bb286faef58f8c8e

  • SHA256

    37e74fa9bd95561d810a994531915e1ee5e8286b7472986365ec531957169725

  • SHA512

    dd9b6f5e13203a2b02748bafd3a7777bf406c309be8192053f2f23802c39a4c9beb07822c88bd88fe4254d604d465a69a6c1fc6d8fe2f5d2dd90bcbf29b5e01c

  • SSDEEP

    3072:PSI57HYVDFKKXg9QflneghkL9zqFLjp3FYLypcNR2DHxZhCxt2Swd4lw+p3:PzkDFHQtghkL2SWVDPUdx

  Score

  10^/10

  metasploitbackdoordiscoveryevasionpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2