Extracted

• • Target

    4851420654d99fcd408dfec53b220a75_JaffaCakes118

  • Size

    7.0MB

  • MD5

    4851420654d99fcd408dfec53b220a75

  • SHA1

    7efd3ffdf899e4a247765ba4fe4a8b603dbe0f6f

  • SHA256

    988e7cd8646ac763f5608f5a803d12cfa2a820e8948f06d0dcb23c2e389135eb

  • SHA512

    0321e485db6933cdbcd62e63bc1fec0c7384257e6162080dfef5fd88b09ba13ad64a704956f5606af8902d39eb61560c509853cf2861e329e3833be9816f784e

  • SSDEEP

    196608:iAmzj+5+NxAQsOfd8iaCmaE3LKln7wjK:bgjNxAQtpwOZ

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2