Extracted

• • Target

    ecc031a0894f8cb27deacd0e9f2eeed1_JaffaCakes118

  • Size

    123KB

  • MD5

    ecc031a0894f8cb27deacd0e9f2eeed1

  • SHA1

    18ed2f118f9f8663aade0aa0ac27fd38bd9e0610

  • SHA256

    af361dbdf2d52575c1d9bce62804443d5bf7db8ba9f6b0c7d36036965285fa97

  • SHA512

    730851f280e05ddfaf222f91c14894bfeca0f2d645d45c03093e7525ae9525c3ca1732c19ded8838b1290afa6faf479798d8f7fbc75cba4f0ab1149a18fcd89f

  • SSDEEP

    1536:oKYWh12cvUDiCeTpKNflAooEesMw2xxLAuEqn/GRt2:oKYaQc8DKTYJlAo3UwOxLAuNn/GRc

  Score

  10^/10

  metasploitbackdoordefense_evasiondiscoverypersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2