Extracted

• • Target

    c3e3a1ada1e43d1c3b4b949fbd1a8a9f_JaffaCakes118

  • Size

    9.8MB

  • MD5

    c3e3a1ada1e43d1c3b4b949fbd1a8a9f

  • SHA1

    dc4d48fe857f3a8e26caaff8035d191823d0e92f

  • SHA256

    ec984635e9acb3dc536a25451206d01f9f2bae6835900aad789c984fe563a04b

  • SHA512

    f7440f591f2a898f0cdfe322b9affaa22c124b8c69401f985821420c6b9744c32aa3c42233925ea1d9db23db7397e441700247d7b709a9feaaef07739d93c3ce

  • SSDEEP

    196608:tF2GwW7u4xWKzTcFxHVpKyAiWrVdcPK8gyiD7ex8QiR1e3kxSSo:XuX1FxGyRUbjD7rQcW8SS

  Score

  10^/10

  bitratdiscoveryevasiontrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Modifies security service

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2