Extracted

• • Target

    d180fb9deeb0fadf992e7ac57fb5cb204e3f527bcca1f04e6507b01f8dc45a0b

  • Size

    1.8MB

  • MD5

    8bf2ca375bbec8986b7f5e08839bf130

  • SHA1

    c9c62acc22354b939da39a23f70cefe2be63f9fa

  • SHA256

    d180fb9deeb0fadf992e7ac57fb5cb204e3f527bcca1f04e6507b01f8dc45a0b

  • SHA512

    594b237711eac3953b4f836fa8c1b5cb2e51326860984c8839131827a1e6d1b5cb255dd1cf0b94d3166b07b2a4a30c4f4355203ee17ff41510adc2b528c50e20

  • SSDEEP

    24576:/3vLRdVhZBK8NogWYO09+OGi9J8CrxzzEB+2iLhUi26e6N5NjQO7EPWdLjwC/hR:/3d5ZQ1OxJgBILj26RMO7aWd3

  Score

  10^/10

  metasploitbackdoordiscoveryspywarestealertrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2