Extracted

• • Target

    c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118

  • Size

    148KB

  • MD5

    c8dd59bf73522b33879f3cce5f828e57

  • SHA1

    8c222824892af3e65d5f1592b184cefd381edb0b

  • SHA256

    eda35a3e0bfcc40a8bf7346284b7abc4e32c0bd5f9132c92a41255923e1c794b

  • SHA512

    c08e9d79b2b8c85f6adb0d83303c1b14ca47b3ba40c2a0545e919e5d4085e26bc91a413e36bc84ea7b38c5591047237b4a2598b89dda57b61d3edd2eebbdd8ee

  • SSDEEP

    3072:e9zPtsX9MmgRfE33SufwpxhcRPFZK7pIC23TbZ31M1CGt0soMz:HXSlRfEnTMxhzpx2jvM/MU

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2