Extracted

• • Target

    f2fec6cd7fb126601698a2ed4113c522_JaffaCakes118

  • Size

    220KB

  • MD5

    f2fec6cd7fb126601698a2ed4113c522

  • SHA1

    b546d286cc926df043ccabbb16c3469443f06539

  • SHA256

    8567ace64bbdd1dbb6a424a0780f8aea46d7ac1e9558dfd5dfcfc3e37aeb3be8

  • SHA512

    eb1225482e481fffb6cee4e3aa12c9146d7d05125cbc73c39a12f31fc3470fa7190df04800d6b80152d0b6518d240943714812981509c908dd523c78796fa55a

  • SSDEEP

    3072:yawE8SILiT0V+iFtPji/pL9YV2gPsoKKGQlG7SKPUqOyqjN2R3cJukfUgf:jwE8ST/Z+2gUoK66ntOJ52FcJFMgf

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2