Extracted

• • Target

    JaffaCakes118_00051fb8cf41158646e95ebed2fb8f2e

  • Size

    725KB

  • MD5

    00051fb8cf41158646e95ebed2fb8f2e

  • SHA1

    1dd7158aef2129c0e7c910d09f99379470df740a

  • SHA256

    edd02836c92115a52892337188e9f64a8a2231f9416015201a3c7684df59129b

  • SHA512

    be0dc613c5898627f3d321c53b621b5104ebae8e6506fd44df9c63357f02188b54f3a5b587dc6223cf40622ddcc9aa95610d3b280749100ca0a6acee2e574f8a

  • SSDEEP

    12288:zUzuJ41kfzopJpegOIuATdfEEtIIRGhDNbYhihmbty8sE/GRRaquHsBg3F2u9lMK:IyJAk0DpbZcl9ZbYgy5GbavH0gF1

  Score

  10^/10

  metasploitbackdoordefense_evasiondiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Drops file in Drivers directory

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  behavioral1behavioral2