Extracted

• • Target

    f32fabb52c6a55408d5090ad23e09d23_JaffaCakes118

  • Size

    88KB

  • MD5

    f32fabb52c6a55408d5090ad23e09d23

  • SHA1

    682b58436b44c1024cf3a2406c7c063a85364a8b

  • SHA256

    fb8612ad030066368937f6ea45c878a213a0728c572646ca41169fbe214b3636

  • SHA512

    2d29ec0b1caaa128cd18e7077764f48e12ac90fa451e054826ff4c7dd62612ed5d79436a5b4c4e7fc41db60dab4373d4109b104ad87e08bec6402623f9f2a244

  • SSDEEP

    1536:c+iFaEtB4Y//aXoo7YMMHY638X7QTW3j/VFVi/MV2CJMfdT:c+iFaEtiY/iXooMMMh387CW3j/j4SAT

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2