Extracted

• • Target

    aaf1fe6140ec9dab4fb5a4ce5f62e08b_JaffaCakes118

  • Size

    642KB

  • MD5

    aaf1fe6140ec9dab4fb5a4ce5f62e08b

  • SHA1

    cb323a9b2e0479d6814f5a20b0b05d2c3272340d

  • SHA256

    e4ebb2c69a427c815f3bb64a524a7e14893029d8be22a25bbca344f35d8294c6

  • SHA512

    3cefc16db096b860202d84e027f65df2ce39275c102a4d74fceb97c0b2cc4adb9f058ba1ade5da3f699f64cb1417a5e3e4207b08433efd73ab11fc0e1caffd35

  • SSDEEP

    12288:4ya+nhKwCElN8wOrH3M9U7EQBM/uvSLTvrQ/gCQNop0BfFP4xPFj0CQ945E:PaYBFlqwwHcafgCMftUtjyu5E

  Score

  10^/10

  metasploitbackdoordiscoveryevasionpersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies WinLogon for persistence

    persistence

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2