Extracted

• • Target

    e934315c9ed0109ba9026a5c3443c840_JaffaCakes118

  • Size

    3.2MB

  • MD5

    e934315c9ed0109ba9026a5c3443c840

  • SHA1

    c3fee19fdb2a02c78d9ad57bf43174aa1386bfae

  • SHA256

    b0d6324aeebfae915c2f3918fa9784f78aae316520d50451b14e367a2be17dea

  • SHA512

    c030ded8f3d08050b3f329e9b17d44da6d82e8478efd61d52619272d6ac60c64521b5a193f3398bbf15c77367369989ff68d48b9df074f7868a25f5fa392f321

  • SSDEEP

    49152:gD+Gec3XpHyCzfqe8GIrkHk4WF8zRu0E1TnsmnDg1CJVaVa4OwHju/PPCvSy:o+G97yGIONWmzRuL1gmnc1CfaAw0K

  Score

  10^/10

  bitrattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2