Extracted

• • Target

    f7322adb60f972551f5a9f734bd5c7d6_JaffaCakes118

  • Size

    252KB

  • MD5

    f7322adb60f972551f5a9f734bd5c7d6

  • SHA1

    c0c2b4265f8d15c8633b7997e9e7707e2a598a9d

  • SHA256

    e13764038fea1ad1225327008eb2a7aeeba2e480c522e4aa17b337a4ebb93b14

  • SHA512

    f2cef0046da12732cbd33a935554e34caef19d6052a7b9fced36419e98ddab3d7c00f54d053c73efe304744b84d8bc658ec3856af61fea7509cdc354f6144b92

  • SSDEEP

    6144:Ec2VOAX4tfZ7u0NuTnTc6ruy3QM4p+vChSY0wc9ngk42ylCW:p2J4tB7u0NATcO3QM4p/EY0xJ42yl

  Score

  10^/10

  metasploitbackdoordiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2