Extracted

• • Target

    f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118

  • Size

    220KB

  • MD5

    f85dfc3c6d0cb691d7341f063a3266c3

  • SHA1

    eb353f245d504107b9007d43bb4dfc96c1b300a8

  • SHA256

    4b95ec1f9aeb58dbe173f08afd61004ddf7d1b28a3f96ed25f19792092328a43

  • SHA512

    310a8d9be8f0cf17acc8e1f66e61ac99a5fdd5c3effd283bc61f91886a7863dd553130f433865e77a7d5530b45b5a3395fcf9d20acc91e54f921cff40180fc62

  • SSDEEP

    3072:W0QEWBtDGLizq1M49YrltEr53LZnwh2e8EjuAbe/1fGyWxvBO61xf5VorCYnFTe:W0afq1MKltnwh58d/ZGyI5d1p5VorCWs

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2