Extracted

• • Target

    a40aeefac93fe3ea25d14ca8b9e59332_JaffaCakes118

  • Size

    84KB

  • MD5

    a40aeefac93fe3ea25d14ca8b9e59332

  • SHA1

    e871c202c32a6888d9f6c324cee172a5375c39f9

  • SHA256

    dcc8ac68fa9c6bb02f2857bed12cb71882cc4de6caf6f6a8b31cb64cc737f689

  • SHA512

    458f269ab1da8280f79138ab8c87fcdef1624af1d134fa546d378b15948f279ce9c6f1625f8bda64cf017318ae04a780116acebb276758174ff06c963e180f6c

  • SSDEEP

    1536:68F+Fw0DNk6taW91hvSBYHkLQCUwljFf+NDH/:68QlDW6L1MBYHkLjtl+/

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2