Extracted

• • Target

    e0866df50713533e04728b04a5286de9_JaffaCakes118

  • Size

    9.7MB

  • MD5

    e0866df50713533e04728b04a5286de9

  • SHA1

    8ea1239123bf01d9c610662b7f511e6dc967dd7f

  • SHA256

    a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07

  • SHA512

    5f0f4b77e6da798cccf7beec865e1b2c964448d45c048d66193c95de93381a561b50f673de8cd8ecc6bc33d672cf9ee57a180fd2edfe26ecaef447babf27c9f9

  • SSDEEP

    196608:SX8+4u9dvKX5onopXD/WVrTm5x6nW40Z5io98N2HBMADiYfNogmNmAiHNv:SX595KX5zpXLKrTLPE0U8o+AD3MmAiHN

  Score

  10^/10

  bitratdiscoveryevasiontrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Modifies security service

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2