Extracted

• • Target

    eba66e4d7c9a936da58556851ce8a9fb_JaffaCakes118

  • Size

    256KB

  • MD5

    eba66e4d7c9a936da58556851ce8a9fb

  • SHA1

    8463e186457689ebe944e9a21b07270128907464

  • SHA256

    803579bca6f45f5f1438cf1570ec5571d642e56af00e95620272f6d454809233

  • SHA512

    df5dd5603656b65c674ec20bef5ef3e9836641db6021fd8a9fc6f6491ccbff95468622cb5d000a49f185e3e2a964dc0f896666d5ebc8290c8faeebca72171598

  • SSDEEP

    3072:k/nouBtf7Gr6FspC8HaJ6tWWUzu5Su/e+RoGhGHWdOOjlNOC8u:kBb7Gr6OC8Ha0tZbbn

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2