Extracted

• • Target

    ee523f0176978f2eb9ff29bb3215c9fd_JaffaCakes118

  • Size

    685KB

  • MD5

    ee523f0176978f2eb9ff29bb3215c9fd

  • SHA1

    6345856c55e24dbc6d4cfef9708582925b71d784

  • SHA256

    e04c2cb66a5a074f17ac0211fad1ea2ff2f37ea684c6818ef7e5d40c600b3c58

  • SHA512

    ef0a0a70cbc4e7c60c69963413f9e00d54fabd730eb5f4182d7a070fbb537094d3b6c4970ef45afab755d517d68d30389d03c3b064def9c4cb2b0f6914157ca7

  • SSDEEP

    12288:zOBItp7ioIt4mAlgdFDb4TzBnlDxKMIQvSGCpVdXsqd1I:zOBC+8IDb4TlnSMlSzpVdXsu

  Score

  10^/10

  metasploitbackdoordiscoveryevasiontrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Drops file in Drivers directory

  • Deletes itself

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2