Extracted

• • Target

    8fa5bfa1accb59f16227077fc3ee2031_JaffaCakes118

  • Size

    124KB

  • MD5

    8fa5bfa1accb59f16227077fc3ee2031

  • SHA1

    01172977dfdbdbf4eddfb0c93ca13ba9d1285a1e

  • SHA256

    11e8fad4c252cdf7eb8e93154eb82449c8e4eb5caecae8009078b847e18bb638

  • SHA512

    b186012827b5a4da764a174504f78a663ae088b75d26bb2e645e222b4d343d73b1b876ae02b85ccd955b609ce29db2a7b52b4022bb020eaade42c128b51eee57

  • SSDEEP

    1536:u/N/0LD8w/Mh3JWxZvB2tzsEw9NUFdJqx+zOX3LicrVIaGkzo61dmCGq:UckL1J2ZJqsDqdJqx+iOcrMkz7bm2

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2