Extracted

• • Target
    jaffacakes118__2f77b36c37414e34ce29df6ed1cf5108
  • Size 220KB
  • SHA256 a5483acb559b71009387af71bf27764a212cd1d8c59a182d5df76885a8cf9e24
  • MD5 2f77b36c37414e34ce29df6ed1cf5108
  • SHA1 30d816b58ce1321ba0005e0ce7266a703a904cd7
  • SHA512 67c8aabf20cab1ba2b1b1fb9bdba96a9f059d2546f041d15287bed0071862765733f8919cbef76d1042c8b8f396e9b055e0324c1a4abfc0e3d73a5bf5ca2dd6b
  • SSDEEP 3072:C0QEWBtDGLizq1M49YrZtCnvAzoRIqPh0vHJkBHwBaa7DQV+JoHoWgqw06DmdF:C0afq1MknYqD50vGxwB37DWN8qU0F
  • TLSH
    T17E24D01170DAC4B2E42751BB480ACBB85B7778891B27ADDB2FCD45DA4B2D2F28A35344
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverymetasploittrojanupx

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2