Extracted

• • Target
    0be5141e1ae50995ecdbfda1a8a9eac4_JaffaCakes118
  • Size 671KB
  • SHA256 dcc66726564a03e56a884b6dd4f0330d0463cd4e28b2bd2647469cc744130556
  • MD5 0be5141e1ae50995ecdbfda1a8a9eac4
  • SHA1 e57b53aaa0bc4462713c604feef9a15d52837090
  • SHA512 c9aafb1150a4ea59e303da1b0dfcc9309d0ea76b77c4183ef8b9ba76995342892958ab0e8a17b524f493e1aca639444d5a201f7709a1a5566f61c92988fd889c
  • SSDEEP 12288:OkjQuPMY7JG9E9ffUsl64u95PezYdJwSK5SbiDj5lAKPuPOW1wAsUlBnPCg/7Uv:zsZ8JG63h648W0LNK5SmDj5lAKi1usni
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  metasploitbackdoorevasionpersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies WinLogon for persistence

    persistence

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2