Extracted

• • Target

    85efc787867accc31df48f652a34d271b2570b9ae4913e8780ae387d11f866aeN.exe

  • Size

    247KB

  • MD5

    ea0e2408ddfc42bcdddbb49ede686a90

  • SHA1

    fd077ed435d222098f952af1dfe371ce66e5d0e0

  • SHA256

    85efc787867accc31df48f652a34d271b2570b9ae4913e8780ae387d11f866ae

  • SHA512

    d24d9b5d2ebd33d0bc34c8e8b96ecd4bdc8d3d46a2a03d9f5aa19e9788468f4a233b0e0fa1c141e921525bf198a798a6f79d4ebfb3bd25c53f98d0bbed38500c

  • SSDEEP

    3072:+i4F1LEepvXtJBgF3lpmmk/QEUGB/QHCx/bz0s7fbpe2olMwW4EIc:+9dEeJX+FvX7HPssRlMwW4dc

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2