Extracted

• • Target

    f8d767e98e8af957e78d511e094920f8_JaffaCakes118

  • Size

    2.0MB

  • MD5

    f8d767e98e8af957e78d511e094920f8

  • SHA1

    62cd50cea9b064a95fbf31e049512bdf2b31d8e0

  • SHA256

    2f6ef42f0d67f7785b9077ecf64403ef5f86dc85447d965a4516109f850fd903

  • SHA512

    556890fcc21e2d5a1ebe00d4acf1258fac0b539cb1e7a304efd3d9db59a2d06c321ac4e2e3ae9f3e3432f91b991f05524918a4a10674e35972ce075349da1af5

  • SSDEEP

    49152:dHA5Mgur5lyqkQbLxDRDvA5Ny73RX2poBMQRAN:i5idkQbND4AX2eMi

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2