Extracted

• • Target

    JaffaCakes118_6578960c947459cf94a7fe1a198dcee1

  • Size

    387KB

  • MD5

    6578960c947459cf94a7fe1a198dcee1

  • SHA1

    53773c69ec64a2bf142bb53189dd20ac469e0410

  • SHA256

    64aefe6340d980fd4e9e6335d963603240017bcfc47c066f4594540b6ed4d091

  • SHA512

    07905b92d0f77d468f5faccd92db4887920daa836f33d0e3a6c44589516a3462d61f4a2bc0dd8a222fffa60881abed20fe97c1f1f6a7d7598145f00b6c91fc68

  • SSDEEP

    3072:a0+e5h95FBnOwlv13zbSCcH88Or1KJ1VbB5XU+bSk7HPbIcJv:5+e3VB1xRbSK86kJ3r7EEv

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupxevasionpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies firewall policy service

    evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2