Extracted

• • Target

    a48c18eb8e4e35b669ed9ea252652fa3_JaffaCakes118

  • Size

    452KB

  • MD5

    a48c18eb8e4e35b669ed9ea252652fa3

  • SHA1

    fcd15abd1a4ce7d967c917351ad7390d177d18b4

  • SHA256

    c92da775a6532d11d569a42e704de2fbc42485b29ecc3c90cfa3468d030e174b

  • SHA512

    7641d12dfd62a79ef8472660668f98f151e5af250ef30d95d35bc48a1ca2a643f2bf178e1d2e2d86b3a4f9bafd824660e333d76fe9e10b34309fe3eafaff0e26

  • SSDEEP

    6144:ise2g/+INC7rGN3bkty0Mki8787O71rkhJSammcmZxRL0hb:iZI7rGNrkty0fkhAlmvPKb

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2