Extracted

• • Target

    b3ceef2dde1288a82ae46bda8d0365ce_JaffaCakes118

  • Size

    196KB

  • MD5

    b3ceef2dde1288a82ae46bda8d0365ce

  • SHA1

    28e978b147317f40fa002cf03b8ebc2e664a847f

  • SHA256

    e3951c2cda7bad54a1114806c41a77f8a6fe75ee79c5fcaefcbf8cd6c1cc3700

  • SHA512

    4d3f562e1aef7981f8048ee8f7edce39f0f866f7ebdf3014a51f53a157f1d26ad58a650dcda647eed895ad534855c2688f4b9583888eb24cffa607d30cc8fc76

  • SSDEEP

    3072:fBn4Fge4DqzBvDqB+XQ8i2VE+xYUcJwFG9SaNHDTg9b4MRd8Kk0NWn:ZnNDqjsSE+lTkS6jTK0MRd8K58

  Score

  10^/10

  metasploitbackdoordiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2