Extracted

• • Target

    efe37b22d8c48e87f8263cf63ecaeaca2cde69b8ef015bfb2ee70378edb15c1a.exe

  • Size

    196KB

  • MD5

    edc469c3a28dcea43681c17070e3add0

  • SHA1

    97e3fe8593ab9dbe08677f3d5dec5fc66e526e89

  • SHA256

    efe37b22d8c48e87f8263cf63ecaeaca2cde69b8ef015bfb2ee70378edb15c1a

  • SHA512

    e73e9d60e03de05ff13240ea5a7fd1007acbb572cb2fb484f90c9f3767c784952383eefdf33cc87ba18db1d1228c41cb684690de60d513c8a2cc7921aec2a777

  • SSDEEP

    3072:QX3HC4cyoRRl7KJ0gZHQnLOJMu2a9AOVZePhXogz5+C:QXXCDc0gZGLWMg9DVMpxgC

  Score

  10^/10

  metasploitbackdoordiscoveryevasionpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2