Extracted

• • Target

    ec18ef42443b23fc4aff8737eee15d8f_JaffaCakes118

  • Size

    173KB

  • MD5

    ec18ef42443b23fc4aff8737eee15d8f

  • SHA1

    7423ae71bdfa78734db1b21bf11fec178807a530

  • SHA256

    1252ab0cd33bd0b06f3c60a794909d1c50189a6aa42d0a3dcf01a40f80c2b6f5

  • SHA512

    c7efa24d047174a611aa1cf7876d2c5eaca0314d133f4f67125f4671a692cbbf15685f44e8c7d79169175773f3fd80c28d1b92e2d81645d895fec278d1a1817d

  • SSDEEP

    3072:WsGEEhlRNs4Z8Gzr27BT+gzDRDxckVC/L2x7WYGP/cliC5uZOT7:dGXHkGzuq8RhC/JlPklBw6

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2