Extracted

• • Target

    JaffaCakes118_b9e32d5abb48fdb60b7992a8f8bc122c

  • Size

    247KB

  • MD5

    b9e32d5abb48fdb60b7992a8f8bc122c

  • SHA1

    e581f862c166d948bbbff20ee34acf4997e56dd1

  • SHA256

    13cc17771a5fd19aaec69888a4294c6880210173c4ac49f86281832253e0dd9c

  • SHA512

    05406b44af1a2b02ecc919b306fc20e88e39451bb459b289eaab2dde9e02da26c3e681d0060c0334ab952d896b74dc1445df09efcd849574d18ebdaea7309467

  • SSDEEP

    3072:lV4upja0uR7JQshBwcb6n0qn6keZou+zYPm2SCO9fWY5VTxrq4GUndT5SMkk20G0:lV4upVq7JQUH60qnnA2omVl5cs5hkQN

  Score

  10^/10

  metasploitbackdoordiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2