Extracted

• • Target
    26ec3a01cb4e3c26f67687e2071c9700e84168b6da19195d6a0412c566af4ce9
  • Size 680KB
  • SHA256 26ec3a01cb4e3c26f67687e2071c9700e84168b6da19195d6a0412c566af4ce9
  • MD5 bc4752a3e1ec6081f11e2d985a7e19e9
  • SHA1 9c7542847bbd3bee5fb65b32d3e3e5b288a03cd0
  • SHA512 1c166f352fdcaf45846bfb37e277351ced4d3404325a60c54fc9a8e88f19c460e1122e625ba23673ba8c975eb4fb825c1d92f82dbaa6e9b3338a05b251c076d3
  • SSDEEP 12288:d6f13oK/cDVrSs0SYnIpGtTjSsgyMfK55lLs7uli30zecy2fP4VD:d6ftojDBeSYnI8tTjSHhfK5bs7ug30br
  • TLSH
    T106E42326EFDE8F2AE5467237D2B97731D4D059F13030A37032E2CD59A811505EAA9FAC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverymetasploitspywarestealertrojan

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2