Extracted

• • Target

    ff442397d2b3b5deab103112c15fc9f4_JaffaCakes118

  • Size

    255KB

  • MD5

    ff442397d2b3b5deab103112c15fc9f4

  • SHA1

    dc568d3b831e64ae635bb1039cd759d63484e2aa

  • SHA256

    bad3b227c4fadfee55cab804971ce79868e0111d02759055cc1f4999ba30aca1

  • SHA512

    1401fb564f0d443c88360f1e5b0d36cff588fbc14fcab98ef36f166fc39abb73a2723f036c0ce3c87fd2a016ef0a628ba3b15230a73ec62b48f071d04a447318

  • SSDEEP

    6144:M6axKLfcApuo/s8PoUBMWMLMFURlbVNMbM0MBMEMZ4mUzOMKMGMlMzMTM:M6axKd/K4URlbV64mUz

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2