Extracted

• • Target
    d22e99d0503a2aa8e7714b7645e8ee89486ef00ed956246fc2ffe24a311d173f
  • Size 1.8MB
  • SHA256 d22e99d0503a2aa8e7714b7645e8ee89486ef00ed956246fc2ffe24a311d173f
  • MD5 6d6fa1e5cf13e1f4bc701d636b2b3b1c
  • SHA1 ec247f750bc8497869a715cdc212adedf8e2cd5b
  • SHA512 34b5609f63a21d62f75edcb8a3fa565a0fe528c31e9de7b0e45a5ca88a1adddd3f0e87c3772d8363f49f25b29946f258eb8afa617f7281e20aee83595f404919
  • SSDEEP 24576:/3vLRdVhZBK8NogWYO09GOGi9JqrixA1DKOf+b4YQCswxCPjYvyB17r5xFHaISMw:/3d5ZQ16xJquA1DKOW8Nr4M7DFHaN
  • TLSH
    T1BA95F227BB518436D1332E7C4C3B9398646EBE201D35A4477AEA1E4C9F782853D2F2D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverymetasploitspywarestealertrojan

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2