Extracted

• • Target

    e39804cab0958dc96d002664a1c32f659d283447e1a18397c3ad84e2d784e728.exe

  • Size

    200KB

  • MD5

    60f593b820e8dd77f42f8fb903226850

  • SHA1

    ed17887140e1b964a4c675b4dfe3b724bbc718c1

  • SHA256

    e39804cab0958dc96d002664a1c32f659d283447e1a18397c3ad84e2d784e728

  • SHA512

    e244a168788874327ca88d6e5975155144ae7f8fe25216184dab16bfc712a20e6d2906d5eae414c9f755ca8e5d3f401a260aea75c420874d08a4c63f95f138a0

  • SSDEEP

    3072:CN3HC4cyoRRl7KJ0gZHQnLOJMu2a9AOVZePhXogz5+8:CNXCDc0gZGLWMg9DVMpxg

  Score

  10^/10

  metasploitbackdoordefense_evasiondiscoverypersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies firewall policy service

    defense_evasion

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2