Extracted

• • Target

    f94a2299d0fe2837603734bbf0c3c161_JaffaCakes118

  • Size

    4.9MB

  • MD5

    f94a2299d0fe2837603734bbf0c3c161

  • SHA1

    15f2d0ea4daf45e0418cd3e2dcfa55bdd1e6d819

  • SHA256

    746b35c07eefaba6dd40aa5a8b2389eb1ca04bed6ba23acd0a732a7148f3f258

  • SHA512

    0fa446b5d20618053d46ff96c538d40deee2da4811c63b876f479ea04442493b9d8675bafdc68a018d5abe4dca78ddaf8b9af46c2586fbe7fafe639613f3d5cd

  • SSDEEP

    98304:fZS0r0bsJoWIUJMKXZy2rdh6RPYFBW6MLrPZsPKZVGOZNmOrTAn:hSHsSWHE0kPYFB0ZsPS8YNHT

  Score

  10^/10

  bitratevasiontrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2