Extracted

• • Target

    eaeef1c73abc9b57cf0b2d88472e1412_JaffaCakes118

  • Size

    204KB

  • MD5

    eaeef1c73abc9b57cf0b2d88472e1412

  • SHA1

    d6775d7a09c291882a1f343642e5c4463513401d

  • SHA256

    f500579ea2f18c90b2fe8317d85e91593b1ecfe66427f7dedd93dc0bc1896523

  • SHA512

    ff7b03df24cfb0cf52204cc5a50af10fad37a40e9b0563872b8293740f3a3c7c6ec841b108bbf8050da0c7a79563d42a3d8423902cea8c277cae47d80fce0159

  • SSDEEP

    3072:aOucr4iXDvSj9i1vnkIqjN+x+y1ofDPQZiJGzSPcFYFAHB0Dd4kO:zrurNOaYeySPc7BS4

  Score

  10^/10

  metasploitbackdoordiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2