Extracted

• • Target

    0cd817392df0112a1f24c59bd8c9c22a_JaffaCakes118

  • Size

    355KB

  • MD5

    0cd817392df0112a1f24c59bd8c9c22a

  • SHA1

    e9b6860cb3780557824b9a939fa4a5272075649d

  • SHA256

    302e0dce67996f580c4700ffb331db4a31a472441627bcbff4936a279cd18256

  • SHA512

    c778bbcc9965b99db5c374bc5d679758bf1f182d7280ed025243414c4225fe423901ba5bdd859c2b33e3444b9a5291a9d905770ef0b51c26bdc6d52723655747

  • SSDEEP

    6144:VL1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19I:VLdcfxaeM6fy/KaVUtgKkTZ73coNRJ

  Score

  10^/10

  babylonratpersistencetrojanupx

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2