Extracted

• • Target

    c22bf75822c2ba55da5573b81efb14d3_JaffaCakes118

  • Size

    269KB

  • MD5

    c22bf75822c2ba55da5573b81efb14d3

  • SHA1

    c8ad9d1fc990762397828329bfa8f4a81fc17cb8

  • SHA256

    5ef2664ad32c8773d3b31364d3661206bb576d3695daf61e966ece331dd1b4a7

  • SHA512

    08ad291b756bb0cab6da43d6b3eb76e39bb5e5605444d7162829ffdf07bd25ef1f02bb9cff6394ed1183e7156cdb908ff0dfd04ad65a5069b2c55969718f1f4e

  • SSDEEP

    6144:1ZEaSuRXbZi+qDP7aOg28wvP6bQ7yMP+DE827geG:kPYr7qXL6b7MP+Dd2P

  Score

  10^/10

  metasploitbackdoorbootkitdiscoverypersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Executes dropped EXE

  • Loads dropped DLL

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2