Extracted

• • Target

    c367847c0456c4d7f563f08619e913e3b048cc9776bf7350778274afbd045943

  • Size

    1.8MB

  • MD5

    86fd864d99255e610c9725cff3cac9d1

  • SHA1

    1bd3adef2b96f1d0f015ff130e759170238b7d4a

  • SHA256

    c367847c0456c4d7f563f08619e913e3b048cc9776bf7350778274afbd045943

  • SHA512

    a9587ce75c58daffbcfef92ed17ad46bc9269d91a445be5d61ff3bf288e18e84e1c2361e9850b2643fc723e4b42bbcf1a0ff3807c6ca966f1bb7e166c71fdcbc

  • SSDEEP

    24576:/3vLRdVhZBK8NogWYO09rOGi9J3YiWdCMJ5QxmjwC/hR:/3d5ZQ19xJIiW0MbQxA

  Score

  10^/10

  metasploitbackdoordiscoveryspywarestealertrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2