Extracted

• • Target

    17753b4da6fa70b9f38fe116371836bf_JaffaCakes118

  • Size

    247KB

  • MD5

    17753b4da6fa70b9f38fe116371836bf

  • SHA1

    6ea4cfd28d81913957b4078fd4816c4fc40fa08e

  • SHA256

    ac83d3e73d69e840f2c48837f844d419155497ab2f55f1ab49967a8f1b891e8f

  • SHA512

    fb7d7a8b5664c442d5ec58d2a36cd7f831aa65b5511bfaf49764c137f4d16e8c88135019e1ec438a04d9e8ed5c2d9cb2cbf51e7e4b927c36b81a0c1135fb132d

  • SSDEEP

    3072:+TFA+zFNys+dvjcX/qD6N2OSEUGo6Vtt3CtSgGGSGzQTeZ8J2CwwL3kqp3:+/zTysGL0C3cXlgGGJXZA2C9L/p3

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2