Extracted

• • Target

    a6827b8e9674e9d1c9126e6598b35b64_JaffaCakes118

  • Size

    212KB

  • MD5

    a6827b8e9674e9d1c9126e6598b35b64

  • SHA1

    66d3763f6954601959caeb0ca74e5526b41b43d4

  • SHA256

    7dcf991ce532bc178b2d74465ec5ad3513473c15572a8955e4a1f737291d679d

  • SHA512

    fedfe77daafc80cb7e701891cb3101dce86dd14121827d68c7f93d4daee3e5fb3d99ed0976cc3fd7055e5f2c39c1cb6bd933bdfb50e6d98b1d748f2f632a015c

  • SSDEEP

    6144:1kvvmzUn7my0rVphHNAoQH1PDnbYV2Fhf:1kKImDrxHEPDbDFhf

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2