Extracted

• • Target

    ac293ddbb97a9b4eeb02fb756f740140_JaffaCakes118

  • Size

    213KB

  • MD5

    ac293ddbb97a9b4eeb02fb756f740140

  • SHA1

    b091334fba1b5466540b513bd458d6bc8dfecf4a

  • SHA256

    1ec01f3b93491952e6f0bc3a94cc752a251de60991e4b4fdbe2a7d607122d393

  • SHA512

    2029c3515241d136df0d0a13735f28ecfc6890f03edd0d35cc67df676a6234d3500d334d8971760c9201bbe40fa3e52fcc38d69e7882b791eb03412ec954f83a

  • SSDEEP

    6144:AwRxlIAXOs5iHw4MSmz6fWnCyyFGhYTZqXcXoEy:h6iiQdSPfWkFTX4

  Score

  10^/10

  metasploitbackdoordiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2