Extracted

• • Target

    f51be466fe0103c6b29596054bc962ee_JaffaCakes118

  • Size

    161KB

  • MD5

    f51be466fe0103c6b29596054bc962ee

  • SHA1

    4a0a3ab920069f05ed889f23dce32cef92bb8b7a

  • SHA256

    ca0fcea9b0c53ccd48a53f54d28288c1553b837a216be00163a56a348ebd3401

  • SHA512

    f2ac31a2ec9fa858b6f43807732c5837997f1a0e0890f4f3dd3ad819c5d2ee5c5c622f9d499ca7ac73a0db4ccf17fef60bac677d94e71a0cd6d91b1416cffa05

  • SSDEEP

    3072:HaQR1ahRGxO7yFDWenXF9fy0Gd7oT6QGlVp1304RnYDAlg/yMYE:HaQREhRGxfFDLFFyBnX3041s/jD

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2