Extracted

• • Target

    b2fc0dd2da1964a2f26ff8a6d4ea2138_JaffaCakes118

  • Size

    62KB

  • MD5

    b2fc0dd2da1964a2f26ff8a6d4ea2138

  • SHA1

    6d1ee519cb099febbbed8479f4f0ef6148faa8fd

  • SHA256

    b6922fce378be3b40f9e88482d142a2b1aacfa4b6b276113d3bc0e4e9208b790

  • SHA512

    8a42277ee29b4ef792d2e19d712355a090a4c0d1c2fd0cedf47f5cffc93b7a4d849c37af1aa66cc0053cecae8ed41c4ec7637df1ba13ac8657103e44a7385328

  • SSDEEP

    1536:5NbYzDLPzrpsG9FClRn2oHPVd9Lj2Dn0kyakAYaO74:54kl5/9LjgYpAYV7

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2