Extracted

• • Target

    db6e72f580b5251da16145f378182b33dbd5781f020d87be64a8785ba82baf0d

  • Size

    247KB

  • MD5

    849a0ee3d944cd53f56e2b3487a79748

  • SHA1

    9b4d61290554211b286bc8310a6163eec8180b49

  • SHA256

    db6e72f580b5251da16145f378182b33dbd5781f020d87be64a8785ba82baf0d

  • SHA512

    5d5a3d05b50d39088217b87900ea586f8d7414b4fd5147de744d1185545771c3153b28711a646adf4fb020aa506bf9b9d015398b74ecf1bc5bc44c12c89907d2

  • SSDEEP

    6144:6g1naEKzJIycoB39jDiEM1OcZVA2YwVGXa1:6g1HEn3hi51PA2YwVt

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2