Extracted

• • Target

    de35804c493b0728da278079d0622607_JaffaCakes118

  • Size

    250KB

  • MD5

    de35804c493b0728da278079d0622607

  • SHA1

    4bd21b8719e015dffbcc6f4dd5a7810e040ee071

  • SHA256

    cc5ace12565a21cc26c7792c0ab65d95c9607099cc7e5435efe68bd42293bf64

  • SHA512

    6dd12c6d8b1a54c9cedf779135cfabd54b17e8d06368208c0ff7fce1f5b090d6523c82110572ec90debf24a1bf88527d2d1a7d1468cd6e4f98ffa8a56b6b6e2b

  • SSDEEP

    3072:TdS5IDGffZVTrHUn/CNZ2vb+IUzcJ2CvHuRBGBiB7olsNd7VWOLaVyBcqcLYG3ZS:E56GffHrHCU/kLvHrByhL7VWOWVy6LYv

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2