Extracted

• • Target

    JaffaCakes118_8aaf6135f756324620c10c7cff249462

  • Size

    132KB

  • MD5

    8aaf6135f756324620c10c7cff249462

  • SHA1

    57b2110f4e7b4809a23c68299bdd9ab72b315ff7

  • SHA256

    82b10e0f46ca7b53146f8f05fec13fc149af4e766c854ca01990b55842424994

  • SHA512

    513b6f98fb13691abc07dbbe308429cb848655fb93cdb0d536e80f4fa3c6ffe1c7871be0b048687c7f4a126be7ba6573ac688d03a0fcc29de8915b45a937269d

  • SSDEEP

    3072:Ou3tma0Z2lcQjpLmQt+FtOgFPGy7QTm5vOTPuf8NrGL+zS35ivT:p3tmaAkNDt+FtOgFPh7QTm5vOTUSrGLw

  Score

  10^/10

  metasploitbackdoordefense_evasiondiscoverytrojanupxpersistence

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies firewall policy service

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2