Overview

overview

10

Static

static

7

1a52ce79da...18.exe

windows7-x64

10

1a52ce79da...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1a52ce79dae983f1b1abb11ee3c79c4e_JaffaCakes118

  • Size

    185KB

  • Sample

    240628-qwlhfascmb

  • MD5

    1a52ce79dae983f1b1abb11ee3c79c4e

  • SHA1

    12697ea58f6f8d6a284922867be91420a3961a9d

  • SHA256

    947d11c9d9b0ed72aa32783e54f0d991fc8f9a77e2c02127864f33e633486547

  • SHA512

    54e19676450d4f0c038859a6af468dc46806039fc2d5ff65652baf1b4647b9520ccb08868a3e2cb777c0d53bffb5cf1a83e4fe7f7d8904e05cf2ee321675eff6

  • SSDEEP

    3072:J9i+dl2NMCKMYz06UOWTuN1yrQg0yd3upd1qnAEzYds7E7/dThEgvJSq:SUQKCKZ46XWiN1sd+pd1bEz2s7ETRhEs

Score
10/10
metasploitbackdoortrojanupx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      1a52ce79dae983f1b1abb11ee3c79c4e_JaffaCakes118

    • Size

      185KB

    • MD5

      1a52ce79dae983f1b1abb11ee3c79c4e

    • SHA1

      12697ea58f6f8d6a284922867be91420a3961a9d

    • SHA256

      947d11c9d9b0ed72aa32783e54f0d991fc8f9a77e2c02127864f33e633486547

    • SHA512

      54e19676450d4f0c038859a6af468dc46806039fc2d5ff65652baf1b4647b9520ccb08868a3e2cb777c0d53bffb5cf1a83e4fe7f7d8904e05cf2ee321675eff6

    • SSDEEP

      3072:J9i+dl2NMCKMYz06UOWTuN1yrQg0yd3upd1qnAEzYds7E7/dThEgvJSq:SUQKCKZ46XWiN1sd+pd1bEz2s7ETRhEs

    Score
    10/10
    metasploitbackdoortrojanupx

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks