Extracted

• • Target

    df78accf6bcbdb64f67d54ce93cb4198_JaffaCakes118

  • Size

    9.9MB

  • MD5

    df78accf6bcbdb64f67d54ce93cb4198

  • SHA1

    b9a65f521bc137faac914cfb201672c432894d1f

  • SHA256

    1ada6aabdc9ec83a088c242556ac520b10c1002954955ae477468abba72a03a5

  • SHA512

    bb5ac7a4e132c2f17080288da8c1da39f07d3162a3affcedc64befedce0af14801cd6785137dbff79c9c54c73a84f42ef4bbf9c23b80421440fa1f6f4b1321fd

  • SSDEEP

    196608:2y1sK2Z4htD8fXvHaAxLtf+ZlnZfywaX92Y6sDet53lF:P1b0GMttmZlZfPaXBe

  Score

  10^/10

  bitratdiscoveryevasiontrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Modifies security service

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2