Extracted

• • Target

    JaffaCakes118_8a0120fc394173bbcb015e12a7ba49d5

  • Size

    152KB

  • MD5

    8a0120fc394173bbcb015e12a7ba49d5

  • SHA1

    2e1414c6d1f5856deeaaf6c2836f0dc1ca307dc7

  • SHA256

    37ef26d17a636105fe06911c54cedfb08ccafbc1e6fe4a2d8814f7400143b48b

  • SHA512

    c68f25523984756d0b5a31c74a7e47ae5491a2cec68045fe0c09a8191aea517ae5f7dbaab8cf3c2b2a4126d8952e1f7daed558814b25caed8f72d29260b40ee4

  • SSDEEP

    3072:6t4ctBhUa6yvcBTZmC0Z4OJhuvniuniNUu7Vtyav:wvKFYZOidUu7byav

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2