Extracted

• • Target

    f2c100ba6f26babec4770228451f1a86_JaffaCakes118

  • Size

    262KB

  • MD5

    f2c100ba6f26babec4770228451f1a86

  • SHA1

    4b717e79b2a32aa90c84c46f8ed4b18baeb4c64b

  • SHA256

    ab81fb6bd7ccc58cbf7e8447cae489f10257fbbbf2ed013944a175f7be5a8281

  • SHA512

    c2db16c0b6bd7cae0651b4dfc5b5ba1cf6472a04f04c4ebf7d7254f89395b1e2c57c34a9273dda7e52b8ba334d890935323f8ce024994eaee8d42911ec6b5651

  • SSDEEP

    6144:ivAsqZeri+nIPtRPYElpD7T97oB7caPN:iv3qZeriactRRJ7VoBtP

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2