Extracted

• • Target

    ef809ac4fbe2ad04c3749e8eda925331faf468546c7d99823212c6c683796402.exe

  • Size

    3.0MB

  • MD5

    1af5edf02ff8abfff316ece781becef5

  • SHA1

    f5bc98cca3a51efe991829d33f639fddd7ed1adc

  • SHA256

    ef809ac4fbe2ad04c3749e8eda925331faf468546c7d99823212c6c683796402

  • SHA512

    7703f6d52625281b0c889fa6c9006dbc445f966af72c2770bffd0a4655f2f1c778a68a9f3ed23f4410caa48df7418deb3ea890e2c92145ba4e9f50b36803435a

  • SSDEEP

    98304:e69201BfKEpPx+gsDcApAbbXWKIpHmgxQAHfqL892:my0gYJmbbXWjpH/Hr2

  Score

  10^/10

  metasploitbackdoordiscoverypersistenceprivilege_escalationtrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2