Extracted

• • Target

    9224de2a1bfd248fcea2f2a6d8665f13_JaffaCakes118

  • Size

    175KB

  • MD5

    9224de2a1bfd248fcea2f2a6d8665f13

  • SHA1

    03e8eb0b8ee6758ebf75b0fa5992354964a9d02f

  • SHA256

    a61afb787ced74457ccbb12a3924f8d0758ff954a5520652210d81b3f2816caf

  • SHA512

    8fb6d09d1fe7817ac0c7e3c482e2b3057bdbdfbc300e7d27d59db05706463631e9d471e37b994afb962dea7faca98dfcb8b6930c0e225811050d6312b2770c4a

  • SSDEEP

    3072:/ZQfuS4xdHdosuSVfEP1QlpRE3iauerBek970l00dHHD6bo6iCMU:/254xdHCSVI18iuerokt0VdHHOb3h

  Score

  10^/10

  metasploitbackdoordiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2