Extracted

• • Target

    ca45656aede7dd59ce1f0e140ed3391d_JaffaCakes118

  • Size

    293KB

  • MD5

    ca45656aede7dd59ce1f0e140ed3391d

  • SHA1

    4614358a0a05588aafe824ec7f35196f048726f8

  • SHA256

    26462fd0046d0e35130b7931e63f887038fe471c007102523636e7c7ae12a8ed

  • SHA512

    ae1e4438df23f90ce582097c51188c55e19946433427fb1469c941ffe3fdf5c139e4c9f0c220136e44ca2dce3f730035cc3007f2f300d5555d014ee6ecb4920f

  • SSDEEP

    6144:E08wLkUthveqDaWM8HleuLPJ+FFWVaJOHO4TyQOI5JgpcvqNplc4F4bsVYexH:E08MkUDvwoeiPMFFJJCXT0Iw5p4brGH

  Score

  10^/10

  metasploitbackdoorbootkitdiscoverypersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Executes dropped EXE

  • Loads dropped DLL

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2