Extracted

Extracted

• • Target

    096024b0cf6ebcbad059c030d43d76451c1a184a2c1f7680f3976718d198de31

  • Size

    4.0MB

  • MD5

    73f86717725bdb7c72c04f47191f155b

  • SHA1

    52baad3486c9b5e04aa4e07eeec8ff67c861d65b

  • SHA256

    096024b0cf6ebcbad059c030d43d76451c1a184a2c1f7680f3976718d198de31

  • SHA512

    e54c85a61e0a2d98ef0488690f4da23ec98cdb51dae4752982a28ff512f4dfe05a4c692e75d11ce0aaa9e4a1412d22562b527eaf0ea9d1f5c7ed43405ff83155

  • SSDEEP

    49152:i1ZXtxDOmWP0pVfuFt37RW9/9pSTQSpItLc8a2n7s+TTCP0VXbpX5Sl35mjAYRGo:atxKmWMs3RW9o4P7hTbM

  Score

  10^/10

  metasploitbackdoordiscoverytrojanbootkitpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2