Extracted

• • Target

    JaffaCakes118_b878794e1fc3caa16b0d824571d56b61

  • Size

    196KB

  • MD5

    b878794e1fc3caa16b0d824571d56b61

  • SHA1

    c74df96505942917f043020af20a3936f02ec073

  • SHA256

    ecdbe16467afa58e98b571c9ff3b409cd6636dc1a9a7fed769a6fa6c1cad4eac

  • SHA512

    52426c048faa066f9b58ce56fcdc764535f1f2982e42e3683bea7cd3fd6a180a58078f6c113ded0e6d1141b8150669c05a13ebd9a0e3132ad96f196dca4a3554

  • SSDEEP

    3072:Mu7ljz+tjKao5jjuB+gudGQ4fWYTgHDYz3W130DFj73QyxhpZfzkC:F8maocdMGQ4ftEHD/yFjk+pq

  Score

  10^/10

  metasploitbackdoordiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1