Extracted

• • Target

    cf4847f50e4c1c0392e1e95876e3d1ca_JaffaCakes118

  • Size

    247KB

  • MD5

    cf4847f50e4c1c0392e1e95876e3d1ca

  • SHA1

    5cf1ba3ee7354a9d1324cc7caaf9553b2e702680

  • SHA256

    a87781b93eee147fcf52c7eb02b2fdbc62eebfbc9b719263f62ed0875290e8ee

  • SHA512

    fa1ee4ec62ffee250fc9f276c8a1da0887b041cd0f45565ebc378c354c86815d85e2e93f059224874a2a7a5f6502545138b2f523e2682f2c3fe3f3ab7b139b7e

  • SSDEEP

    6144:6/hJ0bg5YMCNZNOXnKvzbSSSSSeSS5SSySSQSS8SS3SS3SSGSSwSSCSSNSSQSSvL:6/h+0aMACaLbSSSSSeSS5SSySSQSS8SY

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2