Extracted

• • Target

    a82cb0780c7a48983dc4e061361da2b9_JaffaCakes118

  • Size

    164KB

  • MD5

    a82cb0780c7a48983dc4e061361da2b9

  • SHA1

    08d5188f52214220ccf5ad66b8c4c53403b48092

  • SHA256

    d8c50fb040912e02a8f4c9a34329f0f26244a55ed0494daa5a14e526e59210d6

  • SHA512

    4b64375d5fdf7adf2dc254026404c363dc9c35420a3249455bab1c9085a7e7e3dc2578fba36d184d67ecd83c9aa6864046db871c4dc71aba5c4d2e7e3ed07e06

  • SSDEEP

    3072:m4OwiHtBl7NRDaG9vb/eNtHv6F4Qsq4OFXUTIxPPnbkDw1NXEGUU4v97j:cxXDF9zeNtPc4wFXUTWPPbkkXOl7j

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2