Extracted

• • Target

    ae70e848f771cf4213fed3fe2d133315_JaffaCakes118

  • Size

    1.4MB

  • MD5

    ae70e848f771cf4213fed3fe2d133315

  • SHA1

    1cfd5997b0bad2af1483bac6d065fc466194dee3

  • SHA256

    dbb1f8653534a072152dcf5a1342525f43f1d66360c36dbe95b552a656e052ab

  • SHA512

    3c6fe5fb05ccdcb47f5607a18f0d899663a7eb0864086804b0164f7951b85aeab498c77ca7702658dab1035c81c936e8dd8f24c4980910e97e8144cb84999e6c

  • SSDEEP

    24576:f+IH2bjuHmTN4JTl05UdqkYU56Upxde9+mI9zixlVHu:f+IYuwF5ObxG+Ixu

  Score

  10^/10

  metasploitbackdoordiscoveryevasionpersistenceprivilege_escalationthemidatrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies security service

    evasion

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Drops file in System32 directory

  behavioral1behavioral2