Extracted

• • Target

    898f0ec3d9588199aa00da724447b5bb_JaffaCakes118

  • Size

    2.1MB

  • MD5

    898f0ec3d9588199aa00da724447b5bb

  • SHA1

    0a5a6aa8a1e8fb83b71516d9086d899836410ba2

  • SHA256

    e139a350242af220a379940c1a667891161ff92bdcdbb5acd024076a27ddbf56

  • SHA512

    ff309a380ec33837425f4eaf64de9dbdf1f2446024e93a2ca67bc3b5749c8f417be82e1043858cd45a614d14b3d84fb67537457067e6fb95154dae0271d6fb09

  • SSDEEP

    49152:QfQtjoZLBU0ZId3qgF6TuWrYWjvGyh8iw:Qf4oZ3INqgUT1rYWjuy

  Score

  10^/10

  bitratdiscoverypersistencetrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Bitrat family

    bitrat

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2