Extracted

• • Target

    fd0efa6ea440b31a9a86be56509764f1_JaffaCakes118

  • Size

    5.1MB

  • MD5

    fd0efa6ea440b31a9a86be56509764f1

  • SHA1

    1dc0980755e1ec59100fd10a9eae09509a9f39d2

  • SHA256

    37380e9dba5069f2d83d1784f072f5f698537990c88e5c06dfade29fb257198a

  • SHA512

    4fba660e35b9537ba49f2aa037899f8ae078983f348ebf0fe69b289f6563ba47316bf779b0a689b5071d1c318942b0c2fa0a646e1367df951c48256935e6d86c

  • SSDEEP

    98304:YxAVVAP7ZHhcJEYz5SUbyKnOPNSApZqQtRdkEFNKhTAwoVYKc:YCvq7lhmEYNSUGKOPNfp5RiqlRV0

  Score

  10^/10

  bitratzgratrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2