Extracted

• • Target

    5b550ff46aaf92d78bb0da72372157b4_JaffaCakes118

  • Size

    644KB

  • MD5

    5b550ff46aaf92d78bb0da72372157b4

  • SHA1

    94316bcdada95132fd697b712908c7f73ec42749

  • SHA256

    b06c94d7de8534fad300f2f3fd0f8be304d25bdfd1787ea92193043fbfb9a626

  • SHA512

    44a4dab5b6d3a2bdb9bceb7cd9416368ccd269f62689548c3c29a97137f8f7b16dd87b018defbf6b9f17444e34397dd0ecbc1e30383a48df82d719bba78ab9ba

  • SSDEEP

    12288:XbR2iV3SbpJxS5kP6NGUrL1K+aowflXkIhN0meLEQlTQuDJP:rgiV3S1GmiNGUvg+a3dkIX0meLFP

  Score

  10^/10

  metasploitbackdoorevasionpersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies WinLogon for persistence

    persistence

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2