Extracted

• • Target

    b03e560065ab6214f693cbeefb7eebb2_JaffaCakes118

  • Size

    571KB

  • MD5

    b03e560065ab6214f693cbeefb7eebb2

  • SHA1

    8217549dcaa794db6120f40a97a40ce0e8402fd9

  • SHA256

    d318be6ac749bfb58f0108cda57fb3bf766ae71cdb449df01de58e4304c25ffc

  • SHA512

    ad033157ccb06601066f16c394efd381ac0e3b55d0e70e112c855c712dbdd77e92f3d3a6e24d1e74c3a5051e2e39fe126277733edd7c724d31e3f60aef851d14

  • SSDEEP

    12288:leAdV0FMRfmRSktcuvDHi7E7DZOidezNrKmVF9sBsea7JwHs66edZib:0GV0FwA7rzZR45rDVLsBDa1feib

  Score

  10^/10

  metasploitbackdoordiscoveryevasiontrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2