Extracted

• • Target

    ee07e2746fdd286f4bd19efdcee2ecfe_JaffaCakes118

  • Size

    268KB

  • MD5

    ee07e2746fdd286f4bd19efdcee2ecfe

  • SHA1

    18036976ac897cfb3dbafc603d0e4987696f51ea

  • SHA256

    be1129a90f903249a17cb960dd1409a3ee74b690e394c7fd0aa897bd15afc12f

  • SHA512

    5254838396d8fe3af33cef4be86c47178067d7f2cb994ac50ea815a16d186bde8be8bcff312be2a954801f0abac8784ca5fbee75deef1f4d8458507bf8ffae10

  • SSDEEP

    6144:PQV3eAmEqQWOYX4Rhl7COFmoIukqVgdgUbcg0gQg48LgAg/gYVZgAgcgIg0cgkgO:PS3eAmECOhLCOFmo1u

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2