Extracted

• • Target

    4b8fd05f24e7dd6a8c77decf26006818_JaffaCakes118

  • Size

    5.9MB

  • MD5

    4b8fd05f24e7dd6a8c77decf26006818

  • SHA1

    756afe0c25d5bed2e17ab459fa86f6d78ed01cc2

  • SHA256

    391a0926a39689253c6363a4138d05b6160e73032c97c4b9d6ed63ed8d1530ab

  • SHA512

    45c544268e98cdcaa576617e7e6d39132b2836564c43721478b0b79708057b98fa3c67c5c2c95f19eafd12e14c9cba1b4d50442120e27fb7a1f63e2029357c4f

  • SSDEEP

    98304:eVjLh6fL15rloC3QUTb3oaurBOxaY6qZNeyRb+VXukHnq6HOTUkAtnvOkNj++:7DX3QUv7uYIY6qpRbQHH9APAJOqj++

  Score

  10^/10

  bitratpersistencetrojanvmprotect

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2