Extracted

• • Target

    fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118

  • Size

    163KB

  • MD5

    fbcbe4a20ac9cd0567ba96dafa08129d

  • SHA1

    191ff2231fc3070de345251e89d1f13ea035be4d

  • SHA256

    4b3990375d2eec9f676836a2f46b9dcb1c55854c5ece97ec22218f246f1642b2

  • SHA512

    ce393ed6a4a9218e7cc029a7bc1d0b965f29c5f3e643046092fa9f9a37fd8685db4c2ee0c1424b6828d925fe6f73d89a997762bfcdd2b996582ac97e3ef27392

  • SSDEEP

    3072:k194BB9ZN91eRHm02Voe//OEG8OdmjUtk+Zg43:8ubj4RH2VotmQa9k

  Score

  10^/10

  metasploitbackdoordiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2