Extracted

• • Target

    da3b8b8b369687b0140f1ff2abc6b7b3_JaffaCakes118

  • Size

    4.2MB

  • MD5

    da3b8b8b369687b0140f1ff2abc6b7b3

  • SHA1

    bf6dd0f03e80fe4fbfc8e4222ae4acbee35b68bb

  • SHA256

    313c959b7868e8a29f3402f4dc87905635f2fd0701441db7d9900d31ccd47d50

  • SHA512

    5a54fbf239738105af7306a9c66d513c327c2450e6bea6c6fb115b2fb1224015edf40a196a992abee17ee1edd01ab06df1a69010c4420336b45d67975acada2a

  • SSDEEP

    98304:czWWHWqTQdizfbeuoHtNSvGo9fGyc3/lsrH4ser9:cb2qRz65Mx9fGZ2Gr

  Score

  10^/10

  discoverybitrattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2