Extracted

• • Target

    ebadece19ecc0ea8b3f4c557d97d7254_JaffaCakes118

  • Size

    170KB

  • MD5

    ebadece19ecc0ea8b3f4c557d97d7254

  • SHA1

    827976fc813c01efab0930f6639830252074f397

  • SHA256

    8e3d5db4824582dd14fa93869a4aa1e6c6b5cc435f909fad696c3a74cba33e0a

  • SHA512

    022995c9f6d87bf30408f7ab92937e147a5b73f91e745c6121bbf29d72efd1e763bbef0127b7aebb98f58070e19f274ed159960e2cbc0ebb79e2deb17f4ebcd6

  • SSDEEP

    3072:fXdQ0y3PSVzffK5p8uRL9zk03F8XsujapHJjy+Ycx7VK+iaEfhoV+rc7JCUU:fWSVzfsl9NVFujudLdw+dEJokC0UU

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2