Extracted

• • Target

    d502b0c5801ad694f64413e91d0c7a9e_JaffaCakes118

  • Size

    208KB

  • MD5

    d502b0c5801ad694f64413e91d0c7a9e

  • SHA1

    e13729b19e5f788c204102f3b913da546a8733e7

  • SHA256

    522db5c7be232d1e4593563ac9b6bb7ec1b2decf96c2b25c3d4447e3689b911c

  • SHA512

    3cd99837ccba99023506c13c004ee7094ba3ab6903f100b045226ee34e7a124464f1338bd81c5513062aa0273b2cf803f4d2f87a52447e4049c4dbe57cd2ffd2

  • SSDEEP

    6144:waIj7DihYYYYYYYYYYYY++YlPwNmEYYYYYYYYYYYYYYYYYYA9d2/pZer93yH6mdt:waW2qrMH5

  Score

  10^/10

  metasploitbackdoorbootkitdiscoverypersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2