Extracted

• • Target

    676468f314fed40a1151d580e98226c7_JaffaCakes118

  • Size

    566KB

  • MD5

    676468f314fed40a1151d580e98226c7

  • SHA1

    65d7707909da6e4d2f7aca130e273613efc2e121

  • SHA256

    7d0b4123925f27b39f6fa807c5cbe5503a7076d44402f9a1ced682e4b9007c52

  • SHA512

    33ca83d85f9e692707d9225af75115c71cc286eaebf3289af5b88ad2c6f79873785e42d8575628389b9f9a11dbeda4649755cd44a4b046bae66a6b5076b8c470

  • SSDEEP

    6144:ZP5sIpfoSB6e/uwxkWaXYikTEuj81k1K4np8c2tcQjvyBW9UCZY1geSgX3RrEOuX:ZOIpfZmbXYiLqk4Sc2R6BRxcAEYj8n1X

  Score

  10^/10

  upxbabylonrattrojan

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2