Extracted

• • Target

    a76bde6a5edbd3e8cca4e7dff7a66dac_JaffaCakes118

  • Size

    566KB

  • MD5

    a76bde6a5edbd3e8cca4e7dff7a66dac

  • SHA1

    efe06f0c48036bedc1ee6127e56fc62e95c5fad4

  • SHA256

    c1537f494baf3a2bdf6cd60e6b4dfacde60072bfe6dfcf7d3fd898c799adca60

  • SHA512

    9b7dbc310ab6686cadc1185cb5914df659831f4aa38f48f5574090b350bef5105374f1c29e5bcc86131ac0ea2197fc3b03e40540ed6ac1b79c65b897567ba4f0

  • SSDEEP

    12288:IDJW7JCQEPCVaAG7SiLBSScGxuWr0s9emtCg:IQJIK0AG7KGxRr9eECg

  Score

  10^/10

  metasploitbackdoordiscoveryevasiontrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Drops file in Drivers directory

  • Deletes itself

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2