Extracted

• • Target
    jaffacakes118_Trojan.Win32.Inject.bjnw.3a3451eaff7bea7ef9d6b6a89df2c999
  • Size 152KB
  • SHA256 732fa2f8f7ba376703cc7bde261038df2b91cfda59fef3a6cce9b2e8f2df7b0b
  • MD5 3a3451eaff7bea7ef9d6b6a89df2c999
  • SHA1 0f16610f2f118dd11876d5b8217cfca6ec6f0aa5
  • SHA512 3cc7db4bc2475fede0903e8eab99cfba1bdde4f39ec6c6a7fd4be2e697152cc59e513e50d1ad00bf70cc2bf3a637ef206c4bc9cddd576437cbf7dab196f5388d
  • SSDEEP 3072:o4zoWBuCpQHp1QkdSXLLlwAbhJYxIolf6hJxgUQ3wK:UCZkILJqTAK
  • TLSH
    T1A4E30233B5A4D673C44240FD4868D18A4FABA61157648267B7DC858E5EB33A5CE3F30A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverymetasploittrojanupx

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2