Extracted

• • Target

    c77db0d729c2ddc5c7610065a3db168d_JaffaCakes118

  • Size

    244KB

  • MD5

    c77db0d729c2ddc5c7610065a3db168d

  • SHA1

    0eda7d1ac1bad56eba9ff8da0b81d14cdb866700

  • SHA256

    ef03750b6f1d70d7d27b980f60477c806f17a4e6168ac1bff5e8cd2367aa22ae

  • SHA512

    cefe6682bf07db1eefa8880e5086f5e3c2b2adb25f7b29314c49cf7f682063b530a936a64c791746aa7f06f622dbc961ed9ec98e0b5e4e64c7de0bd46c60ca30

  • SSDEEP

    3072:4jx6x0SORJBiLiZhBxKrUeTST7t3phv+/1+KfskdrielYWuM9D6mIx3:U6GSORJLheOTXhv+dRskJYWuoHU3

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2