Extracted

• • Target
    超绝gamesense-sk破解.exe
  • Size 10.0MB
  • SHA256 7d9809a764f86eb890b2c0fb9e255e7dbf67fbb35561e05c22c7129fb95f660c
  • MD5 ed51dd620eb9af9a93fd2b990e48a6cc
  • SHA1 4b7a65a9dffb2ff82940fb8e5db5147b13978333
  • SHA512 75179d7847803da9806c1f2f281f75a409820c8f2a45372722477f72985c488b7ad02972016b2a06610fd5eb424b29f0080c62e1092939e45e78700035b534dd
  • SSDEEP 24:eFGSGS0LpFaknehtht6dp5RG1Y/YKZq5zeNDMSCvObp:iGS0LfnehthEdsqQ/zSD9C2
  • TLSH
    T140B665C773256CB2FA790BFF8643CFD692FC7B3553A7075A0228012A615152AB960F82
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoordefense_evasiondiscoverymetasploitpersistenceprivilege_escalationspywaretrojan

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1