Extracted

• • Target

    93685edf0e126c0a14238b53f5065de4_JaffaCakes118

  • Size

    88KB

  • MD5

    93685edf0e126c0a14238b53f5065de4

  • SHA1

    3ef7e6eb8c08a383438addf46d12d39665df6ed3

  • SHA256

    040915ea28502cdec3ef73ff1fa3721a34d0e1863dc5e1e55904d866b1492128

  • SHA512

    a582b57a868319deca69c8f9f40860d435c73af44f94c30693735fc499bb203f6fd7988e8bae2217bb71190b50ec8f1c40d45e6075595f303a20658a770ba923

  • SSDEEP

    1536:2+iFaEtB4Y//aXoo7YMMHYKXrX7QTW3j/VFVi/MV2CJMfdT:2+iFaEtiY/iXooMMMRXb7CW3j/j4SAT

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2