Extracted

• • Target

    da3b3abdafffdf7c1e753adb04ac050d_JaffaCakes118

  • Size

    180KB

  • MD5

    da3b3abdafffdf7c1e753adb04ac050d

  • SHA1

    5f12a97ec90418047f135d746ec36f778ce1e2ef

  • SHA256

    bb2e9955dc4978105b509db18d0e3d461b842233a820b1c3f2b4a98fa565b48a

  • SHA512

    1a68e27497d4eeb0607983d134cbd265057ec601bb269036b76b8a5bc2e86ed1a720959df35b4397d8677eab09d9e59d9891ec6f5438cb13a8776bd378f731ba

  • SSDEEP

    3072:4/u4HPElLA8tyHCIQVsM+VUq/l0BgVB9JktJha3xd:iugEtyH/Qr+Uq/VBJkfhY

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2