Extracted

• • Target

    f9a87b4081bb66670257d4315cee9cd7_JaffaCakes118

  • Size

    57KB

  • MD5

    f9a87b4081bb66670257d4315cee9cd7

  • SHA1

    7bc661a739927e5751cd85f7055b43a3d162f837

  • SHA256

    a8b080c7407037e07946498abeec8046fe6296255b87c76d292eec7439f31aa7

  • SHA512

    9b45848c4e3e0a07eb2240e90e37bda35a52ea05a6b8cb6c34f5c640cda3cf3f70bd51c4f493df49786970033572e610e8401855774fcc8af998d74b469cb3ab

  • SSDEEP

    768:zYdI0kc7Lsy1lH3FXll6yOdCYfkFYDG4rcor4JDDSVIr0ihR:kyi7LD15VleCYcoQorwDDS1ih

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2