Figure 2. cloak.dat file used by the SysReturn software We quickly found out that the extracted binary isn’t malicious, but we wondered: is this binary somehow used by SysReturn’s bootloader ...