Extracted

• • Target

    acd8c340825fa8d129fa9d994ea5189a_JaffaCakes118

  • Size

    89KB

  • MD5

    acd8c340825fa8d129fa9d994ea5189a

  • SHA1

    757fc05fd92627d1395c53b40d448ddcc1e62f7d

  • SHA256

    e7532cb36d25191781832a57dff5423648080c9c7e8d431155a601c8e86fb703

  • SHA512

    778294f645a147c64164353e543b1e761dc29f170bf9a4e397bcf1bdec6a90de43e2f0dc256b04c8920fb03e2ea5c0a02b2f84a1a74d32edbef53049d2ce5f52

  • SSDEEP

    1536:zOpOWmH4UIbiV8EEhHX4VOykVf25lOjBXIINKhRGsqsQVS2Hwg:+OnH4UIbiV8EGHX/fUluB4INKn9kl

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2