Extracted

• • Target

    f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118

  • Size

    361KB

  • MD5

    f6050e141fd57f5bd30f6a6a59200002

  • SHA1

    d94b5a399974d5c1b3c61fea2d8f96c32f4dbd95

  • SHA256

    dbb9c508474f2afac3b0f9addb0d617773bfd4ea47b2e0d55d8833d11b420f67

  • SHA512

    b521eec5d49d2ade2b3e279ca3b1552ac05a0bf4b330d0129c14ada621675d1d49acc1c5b7327a55c0eb9aa44fd34cc2f49580af7918d198d37627148b0e6df2

  • SSDEEP

    3072:7D0Gvk2CF0CYG/ci9Hye10KNvfbRPcFO5/9oyvmMXGfI5XFz4lnDIA4FArOyTDcG:knLYIPeKZF0FO5/9oyOMXGCA4dQwg

  Score

  10^/10

  metasploitbackdoordiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2