Extracted

• • Target

    cf81574bfd0c34bffb636efa63efa0f0_JaffaCakes118

  • Size

    428KB

  • MD5

    cf81574bfd0c34bffb636efa63efa0f0

  • SHA1

    fa186795a1de315edd7988be44346607a80f3a85

  • SHA256

    bce700e3f98fb9c8f690133b52da7ebd187be3ccb18ca9b54444ec6fcfef9a0b

  • SHA512

    c30f5e35182bfb01593fcd1b9518edd563117a5ea17b008db6259fb453fc932c87d8367f7d8dc7bc278c0900dc632c880fd50b318d912fdcaeb49f2507c655bd

  • SSDEEP

    12288:ecYl31OjetfMs3C79vAJ5Jas677NwV2oC8:ec831O+f/9oo

  Score

  10^/10

  discoverypersistenceupxbabylonrattrojan

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Babylonrat family

    babylonrat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2