Extracted

• • Target

    JaffaCakes118_8aa0896372c84465ec2c153ae0e52cea

  • Size

    189KB

  • MD5

    8aa0896372c84465ec2c153ae0e52cea

  • SHA1

    02e86601cd1dc584ee59cd7f45607ea3cc4d79f4

  • SHA256

    2f64c0bb42e364108eb4a8f7134f5dd59aa64862fe8b1fed62aad9b2757fe4a3

  • SHA512

    706a25651a10a16833a2ecf96f88442b9920ccd160b140bfccd716fd86547a17824aa34ac220ee331977dd110c488a4e84580f322066a541e88dbe45b02ccadc

  • SSDEEP

    3072:VX1T/7/i+aCYjYT9IbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7bm026qes:rTj/i+aCOG9GwvP6bQ7yMP+DE827y0x6

  Score

  10^/10

  metasploitbackdoorbootkitdefense_evasiondiscoverypersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies security service

    defense_evasion

  • Windows security bypass

    defense_evasiontrojan

  • Looks for VMWare Tools registry key

    defense_evasion

  • Deletes itself

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2