Extracted

• • Target

    9d9205befd48b3d67ad2c6a1e8f40d06_JaffaCakes118

  • Size

    248KB

  • MD5

    9d9205befd48b3d67ad2c6a1e8f40d06

  • SHA1

    59f882f420f135baa305507f5baba312b6ff9983

  • SHA256

    d6abecab9839ebab1336a822b23be4a846f50039844ad9e0657e408f01d0d326

  • SHA512

    1c00c5079fd42f8916e747cd338c0b2c1720e6515c01b10e80c2758c3c8b3ac65fda06dfeef7b5363e8926829df66e7650e6af3f41412fffdc78f0bb06731a2b

  • SSDEEP

    3072:wyKe64rz5/lzD8A6LmPdNJGhszlMN3Rz46RVO8Cc5LbKpo:wy56alPdNQWBMNNxVOwL

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2