Extracted

• • Target

    2b17e88121f688966b5c9313e9680f01_JaffaCakes118

  • Size

    2.3MB

  • MD5

    2b17e88121f688966b5c9313e9680f01

  • SHA1

    8ea541ecfc7d8d0039262ac4d49507646973bdd2

  • SHA256

    78ac173de38f6be4ec1686d84a71082838154d42ed05e970b574a9e82b76800d

  • SHA512

    c6118eba8bfe3189c31d9b14daccbdef964a4525b10cb193a0634b75acb8cf05f7e44c5332977dd7a9c287a1c0b87914531b48523c277ae00207fef13626ee4b

  • SSDEEP

    49152:QxuaNlMTwUu863Q8dWW//xHHyOQjznJH3ODjvtVMY:IrMkU58MKHyOiznJXCjvtKY

  Score

  10^/10

  bitratdiscoverytrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2