Extracted

• • Target

    8c973db0ca7a75ded4698e44abe50797_JaffaCakes118

  • Size

    243KB

  • MD5

    8c973db0ca7a75ded4698e44abe50797

  • SHA1

    95c9e0213a519a79ce4905d3fcb940ef7415be02

  • SHA256

    cd5a43117d09dd2540974526220dd64c41fe70839767896201cbe650c3e9c309

  • SHA512

    6028cbed3a95c23514f6851583e01e83100f98386cc4551777dab83a7e6738918689bf573a1fc8743ba74e1ac1ba375a1e6ab7797a9e4f41bb71892b96bde00b

  • SSDEEP

    6144:KJmGJmPZ08N9Dj44xsll9/n7q8+4heKn:QmGJmPC8N9DcJZG8VZ

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies firewall policy service

    evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2