Extracted

• • Target

    d2336f1b087906acf7687031caa9b17d9bbe44d14abec76039e45112ac2f92a7.exe

  • Size

    220KB

  • MD5

    30e73f871d7eea01c3b848e2c89142b4

  • SHA1

    81a18f8c3df46c501af7f555b6a42f55f9601c7d

  • SHA256

    d2336f1b087906acf7687031caa9b17d9bbe44d14abec76039e45112ac2f92a7

  • SHA512

    4b505debb845bd6196cac0e29bc4b0b806f2ea47109c2b1ad8bf8456ef1993ca6bb78db167426ea88dc57c6773056af0f69acce51531d5f250a489082e0cdf90

  • SSDEEP

    6144:t1JIfielipuGOMlliO1DmWIgff9aGzde4qz7:t1JKi8ciYq0fZzqz7

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2