Extracted

• • Target

    7cba976f2121e98ba57fbcff02eea07e3b6d113c717d32a4a913cf2cc81e7ef3

  • Size

    3.6MB

  • MD5

    7008cd24b89b995e7ddfdb25b0b71211

  • SHA1

    d5630e4102bd5c228f02c81db478850342b2a19a

  • SHA256

    7cba976f2121e98ba57fbcff02eea07e3b6d113c717d32a4a913cf2cc81e7ef3

  • SHA512

    49a249c36e3b75dd6e0bae7986438c35db5d4f131661d72fab6b54f0b30b2b62dff3ccd48e0d3d69d6092f50be0f7e1c90c93bcbd6ecb2cfbdd98a6fc01449ff

  • SSDEEP

    98304:y/UwoQpBAdUKRH0GtZXlInN3JHEFxqxlIWiKe/s9aXU3q0W9qnVXiP8:yVoQpKdUKRrlIN2Tq7IWbIZU3U9YVs8

  Score

  10^/10

  metasploitbackdoordiscoveryevasionthemidatrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2