Extracted

• • Target

    2c3ea84f78a57ff7d0d829a87d99bb46_JaffaCakes118

  • Size

    3.5MB

  • MD5

    2c3ea84f78a57ff7d0d829a87d99bb46

  • SHA1

    5e13c910dd2e1f2e94e0e100c5e52e0309e0c0fe

  • SHA256

    1bbcaefe187d942ba74a81a41391c22488f524c40e28f8a6098b8ebd2dee1191

  • SHA512

    82216ddb75a91385f099e5c229dae7ac83ba0c4024f919637bdb31df81d4bac98684b7a6eda94d6ccbdb894dbd20d1d2a88661125882d7738c1e1ecf24f5ab90

  • SSDEEP

    49152:fPpKRyY55AXv5uMnSdbBNFeSvwJBt63srO/szDl8GVPvWRlaM2SLUJfEcRwaXMo3:5KRS59SbBNBvOWevzDl8CUQRdJW+3

  Score

  10^/10

  bitratdiscoverytrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2