Extracted

• • Target

    f3b19fab302f6b58718f5f143867838e_JaffaCakes118

  • Size

    86KB

  • MD5

    f3b19fab302f6b58718f5f143867838e

  • SHA1

    60be32421bea85d8deeeee12d412f351fd7bd720

  • SHA256

    ce49d8f10cf3aeeef607e6e90f0bae3c67f045c3f27dfb35ce497ff02ad0d516

  • SHA512

    e76ede653714abb99ca9c0513c984513e9ec481bfc221d784d6b20aa95260164b3e4973e5c22f0c979191c49bb2bd17ca949efed3bc3d6c8519fbf44186e5553

  • SSDEEP

    1536:mWeKIGlw78TlEoK87SGKB16JgYPdZQfKEuboYjrWt0TSwU6:Z7mr87C+bQfluk50TSwU6

  Score

  10^/10

  metasploitbackdoordefense_evasiondiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2