Extracted

• • Target

    ad795a4a1d61f3461f3c56a5d20903cc_JaffaCakes118

  • Size

    84KB

  • MD5

    ad795a4a1d61f3461f3c56a5d20903cc

  • SHA1

    1e76bc93c46c15960159abf9cebbc10c16b895f8

  • SHA256

    e8e5292f99489bc64389d903609b7abf9867180ff89a7d5d0dfaac9cd863d189

  • SHA512

    b1d7ea8aa7e013fd3b875acf65b087846c6c437481e8c55d41c697cc72228ec447b6d139df37082347d9473ecd1a055076d5afce584cbccf25f43d1ff433838a

  • SSDEEP

    1536:fFHLKIX+YQGPoD5B4k91iv/KWJ8QCUwljFf+NDHi:fFrKIX65B4C1iv/KWJ8jtl+i

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2