Extracted

• • Target

    JaffaCakes118_98cdd00fe52cd60d034e98ff0da12325

  • Size

    84KB

  • MD5

    98cdd00fe52cd60d034e98ff0da12325

  • SHA1

    08d9a5c25e1ee9494ee9e50b35bbdc51e5d248a4

  • SHA256

    43e45d7f2375a2197d51b7d4fc2791a0b23e06fd06a217b98099b66939148103

  • SHA512

    dcdc96ea83fd582a7f7d2d55a76de434ee45c7d537569ea7e52d06fad636531a643397ab51d093990a847ddf33a6b5441c84625425ae2dff91591afccc49eb65

  • SSDEEP

    1536:hCto/Bf+8bXf9m4Se7xcMsJZU9TCdpJ5hhLoqcFDgDTCoPXL:c8zf9mhuuMsJL9TCo

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2