Extracted

• • Target

    b4988d8f11dac34fc9c954b20f31ed74_JaffaCakes118

  • Size

    46KB

  • MD5

    b4988d8f11dac34fc9c954b20f31ed74

  • SHA1

    5c67c51d41e00af98bafcd0ff88557efdaecb461

  • SHA256

    cc34c1bb8def74303730293e207599946149d9193100f76982b7a533c1dfaf7b

  • SHA512

    6ad6f3205e0c3e3f6fa96ab5cdb13f3d9e9c04773845c853513cbaf3968db62e7a340c7c4f4c9a498ea3941507396e33ab6a33d78b40c63bad709398390912d2

  • SSDEEP

    768:b/JHBxlxnwxwlnEe8CYZvyGRd34ZXSvZDnPDVTkLXc2va4mIorC/BJyq++EqiPxC:bvxTywOCYZ6GRd3aXSvdDxkLs14Fo2/v

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2