Extracted

• • Target

    a20f3a89ecb11c1d39b663cfb3952a15_JaffaCakes118

  • Size

    196KB

  • MD5

    a20f3a89ecb11c1d39b663cfb3952a15

  • SHA1

    312200b9fcda7cffe619b091755a8e8836e1d316

  • SHA256

    e75f06a0e8dcaece61c01161e59b1f08d93be843045f88d03d6c5a8541e4d9e5

  • SHA512

    cbaeaa929c60a5114f3d384731d9f59ca5a3d026b7266cd3ed745c87844dea75193c60fb9b91934a4b516236ba9a02f4bcb5f4cf6d9384b0fc51c0ae63933fd2

  • SSDEEP

    6144:9pXAT/y1NPXSdqJ2HGEwTDOc0NbFd9o7717JLWZ:c/y1NPCIom5TDy5di17JL

  Score

  10^/10

  metasploitbackdoordiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2