Extracted

• • Target

    5e59494d3a2fc44147d0318564650393_JaffaCakes118

  • Size

    4.0MB

  • MD5

    5e59494d3a2fc44147d0318564650393

  • SHA1

    d089d7201ac6adaf70a547b754ee48e839643844

  • SHA256

    2dd362ecd871dc5fb308a1d1629a657f2e3144c181e6450756e2865b6f0869ca

  • SHA512

    53da767bfa7d46475ded9995296345da247cd3e9a98ed11841e18216326fdbd81d1ee13fba94b60618286f25be5d07243001f4f6f7b6507a9ce9ced75eebdd06

  • SSDEEP

    98304:kQeauo7Bnr3VGKkN2YxQ6BmvS4KB0hUXTMpJgGFwN6bmNNuRhEt:deC7BL2Cvsah/pJgTN6bmNkDEt

  Score

  10^/10

  bitratpersistencetrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2