Extracted

• • Target
    02e266691fffe3cb3dccec92693f3be140e0d5b08dfd78a6aaf227f7a5043a1f
  • Size 1.8MB
  • SHA256 02e266691fffe3cb3dccec92693f3be140e0d5b08dfd78a6aaf227f7a5043a1f
  • MD5 8cb67a19134cb9d0de6852021a10f786
  • SHA1 e75af3238597bde0aa3b86784d4196f617051abe
  • SHA512 5c2cefc17950d9e88b06d65c2c459be2d15a24306e950852b507c90bddce9372c709bc097a8fe6977f55b8a796c64b94751838eafd31846fb6473d46fd20a831
  • SSDEEP 24576:/3vLRdVhZBK8NogWYO09vOGi933YiWdCMJ5QxmjwC/hR:/3d5ZQ1Rx3IiW0MbQxA
  • TLSH
    T19A95D027B7518437D1332E7C4C3B9398546EBE201D39A44B7AEA1E4C9E782853D2E3D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverymetasploitspywarestealertrojan

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2