Extracted

• • Target

    b1130b1a68cb35dd40649a8f9a46c6b2_JaffaCakes118

  • Size

    247KB

  • MD5

    b1130b1a68cb35dd40649a8f9a46c6b2

  • SHA1

    60ca3cf18cf9017c76b5ca93e9ed75e7dcdcc4c3

  • SHA256

    d75bd5b27d406f50b208ba3656642ae5f6d70a44bafc549318e0883e77b1f2d2

  • SHA512

    3492e742fd2b2302640a39ac1adb4a4385f9ce18f73ba4db0baf0042adb41bc92d9568668f14b252ad2df5e58d9c4f0c162f68a76c4bb1f94c7203c71d56dac8

  • SSDEEP

    3072:ZgJfg0QflE2AREPXSUws0jd4pKiLGRYFhJJvRmJQHbZYLedaxT/qEEDYXD8QENO:ZgCT22VPS2U4pKiLSobZGeoxGYwQE

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2