Extracted

• • Target

    a07ca99f0834243f6ebb834d6b776659_JaffaCakes118

  • Size

    270KB

  • MD5

    a07ca99f0834243f6ebb834d6b776659

  • SHA1

    0b9df698a1f9dfccb564861305085a76b0a95b44

  • SHA256

    6991210fa8d7a4cbe26ec93ed0527cb86a868f886941cdb7b74993f009bb4178

  • SHA512

    3030da509754e464be60964c09ef0f33a2b9c35f5e5ff0cecb37d57d43adccc2d25d5ac95081e697cc0e1eddf65327757a6b5569b7d3b7c8839a0ec69cec66d5

  • SSDEEP

    6144:RRHarDVeNP2mKF78tMoq6XJLeEeEVjTw5R0PIz:Rp4ZeNP2my8tMoq6FrtGow

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2