Extracted

• • Target

    98d6614a15ac9caa0ed6a34aef5d3413_JaffaCakes118

  • Size

    263KB

  • MD5

    98d6614a15ac9caa0ed6a34aef5d3413

  • SHA1

    10a7322ebb2dc861c925bb0e59080010db6a2a12

  • SHA256

    f5dd4d40fd0cd780c483507baf299d9dbdafadc5291578cbc572d046eedd2a3f

  • SHA512

    baf6accdacafaacd71a501e684442bcbcf0edde2add12323212a7f4ae7155410e7762ced55ff4bc3925c3e2c261337aa1d525cd85fcfe0775431285f26d1ad21

  • SSDEEP

    6144:gYrLk/6q04ewUIDWjLNWvYkcSjz0DFhtVbDOsjS/H/Jka1+4:jrsWHNyuSjkt5ysjS/fJkO+

  Score

  10^/10

  metasploitbackdoordiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2