Extracted

• • Target

    4fb3c8a4e8ce38d764a2cbd398a0e76b22f1eee633ef780ab1eecf13c3baca2c.exe

  • Size

    169KB

  • MD5

    e83af87e383252472f4ca9f82cccfbc5

  • SHA1

    6214e06e15d90ab6bacfc0fd060ff5016d57f8fc

  • SHA256

    4fb3c8a4e8ce38d764a2cbd398a0e76b22f1eee633ef780ab1eecf13c3baca2c

  • SHA512

    e881d5e3fa2738bbba085b5a3fc6594471f5851b25124113ec1c62ca3e52fae67734e96e02f0a023e2a3f69b8115a384a0d58c53482f6a24748c7fd61d087e2e

  • SSDEEP

    3072:T2+GEkAt+zuO5J20X6dyAvqsmdgqMeictkS418Odmtuo5A7Soz2W+:rkbuO5J2Xyt1JS5Dmtuo5A2oKW+

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2