Extracted

• • Target

    JaffaCakes118_031c03291b4811e1330e07feefa8ef06

  • Size

    64KB

  • MD5

    031c03291b4811e1330e07feefa8ef06

  • SHA1

    b2ed1845da28d86dde7bfa7241b9580279f89219

  • SHA256

    ed0e9ebde361fc77d331bb3b715e4ae1dfbd9ba4be987d6c946f472e01fe6c44

  • SHA512

    a895b1b5735a707a06b7a2e2e0f301f09c2a83c0288cbf6b74a41576124099b7110fa92bb84afbff0cfd81021b230f38abf9ab2267d0639242d486365cb3d89b

  • SSDEEP

    768:og5SRhMoNo9nD3GQHJOTQKIPII1m4lTfFz0FRDMh1ORiIyIunDHoh3BOGqa+xP:osdJOTnIPIilkDMhURunNGmP

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2