Extracted

• • Target
    7-zip.exe
  • Size 3.9MB
  • SHA256 9f3e0a082d374772dba3b6b795666b811ce92e986acba354d4de97263e56fca9
  • MD5 a6679049c64df58494264cdeefdf3205
  • SHA1 951770ff41c968b4a421cf0fc9de0fdcd57c7b62
  • SHA512 d039ad8eef0f2ee0fd66479f724695c7d73c194a79babe2fc0e1b6af10b5645eb1b5d875b788722e79c47097c8c6f949061f0f7f977723fe8e765dc720302f46
  • SSDEEP 98304:Cg+q4dfB9WAdkYhtxg0zlo6JX9oNthcfCGUE0cdTV8:CXNJ9WAGYhbb5XX9C/GUERTi
  • TLSH
    T19816334C9408C0EBE9111E755BAECFE323E9BC005951880F739A7B36A7B5E45EE14F92
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoordiscoverymetasploitpersistenceprivilege_escalationspywaretrojan

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Modifies system executable filetype association

    persistence

  • Drops file in System32 directory

  behavioral1
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
  • MD5 192639861e3dc2dc5c08bb8f8c7260d5
  • SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
  • SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
  • SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
  • TLSH
    T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral2
• • Target
    $PLUGINSDIR/modern-header.bmp
  • Size 100KB
  • SHA256 329d5076827fa394b5a3ad5c125d781a6043bebc849c3adbec240ab047598f41
  • MD5 d62114ddf8281fe70e4b3724c248d513
  • SHA1 94e779b898b94c5d53537fd89c42a6d84eb2251f
  • SHA512 205847b9e57dd274fa4b9263ce9b32eeee5dc7898df2cff973c8861765101d27ca966b57b50bf67667b4d8607b5e7b87e55ad48dc494abba2f772a9d3f0fa2b1
  • SSDEEP 48:48jUWDaSBi7BwmD849rTiRX1FwXEy5i2XJ2t55YyZdHLM0:nD5iymDB9rswXLEt5P
  • TLSH
    T14EA399B0BA41C49ADB540D72FF26D4AD86C73EE9EA505B27B0D3779F5B303527A4A800
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3
• • Target
    $PLUGINSDIR/modern-wizard.bmp
  • Size 603KB
  • SHA256 ee13539f3d66cc0592942ea1a4c35d8fd9af67b1a7f272d0d791931e6e9ce4eb
  • MD5 4df53efcaa2c52f39618b2aad77bb552
  • SHA1 542de62a8a48a3ff57cf7845737803078062e95b
  • SHA512 565a6ba0c9afc916cf62dac617c671f695cd86bd36358e9897f1f0e1a23a59d3019a12349029e05bf91abfb7b213ef02fc5c568a2bfcde0e3896e98cbcfa623a
  • SSDEEP 1536:9Bn13fmACap7r33OCINrac3aKumetKPKqDjoo+1q7C3DNgbgNgLg7gRgeHRVAVVi:90aZr33XW1
  • TLSH
    T170D4C289A4DA5F5D6A40E11198B2FCC4AC923DB6231C9D2D0F3F735AA2F32487948D5F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
  • MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
  • SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
  • SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
  • SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
  • TLSH
    T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5